Can a user with a disabled account browse anonymously

I'm running Confluence 3.5.13.

I've got SSO authentication against our Active Directory forest working using the NTLMv2 plugin from TechTime.

Users with an active account in Confluence are logged in automatically, and users with no account can browse spaces as anonymous. No problem here.

There is an issue, though, with users who have an account in the Confluence database which has been disabled. Whatever they try to access they get a page which says, "You are not permitted to perform this action".

My question is this: Is it possible to configure Confluence so that a person with a disabled account is able to browse as an anonymous user can?

Deleteing the user's account is not feasible due to references from content they have contributed in the past. They can log out, but as soon as they go to another page the SSO authenticates them again and they're denied access.

I think I need a way to give users with disabled accounts the "Use Confluence" global permission while maintaining their disabled status for other purposes.

3 answers

1 accepted

This widget could not be displayed.

Well, my first attempt at the answer would be... ask TechTime? Oh, wait, that's us :) Thanks for linking!

So, let's try this again...

1) It is possible to force IOPlex Jespa (the library that actually does NTLM authenticaton under the bonnet) to install an anonymous identitiy into the session on logout. This will prevent users from getting logged in again immediately after explicit logout, but it will also remove the possibility of logging back in again by just clicking on anything outside of logout page. If you do want to go this route, just add/change this in Jespa filter definition in web.xml:

<init-param>
<param-name>http.parameter.anonymous.name</param-name>
<param-value>logout</param-value>
</init-param>
<init-param>
<param-name>http.parameter.logout.name</param-name>
<param-value>logout</param-value>
</init-param>
<init-param>
<param-name>fallback.location</param-name>
<param-value>/login.action?logout=true</param-value>
</init-param>

This tells Jespa 3 things:

  • if you see logout parameter in the URL, do logout.
  • If you see logout parameter in the URL install anonymous identity
  • if for some reason authentication fails - go to login form and install anonymous identity while you are at it

2) This specific use case is valid IMHO, disabled users should NOT be logged in into Jira/Confluence even if they pass NTLM authentication. I will add logic to handle this into our plugin. Watch this space!

Joe Clark Atlassian Team Feb 02, 2012

Great tip, Ed! I've been doing Jespa installs in Confluence in my dev environments for a while now, and I never knew about this.

Thanks Ed. That's a big help. I've added to this by putting some code in notpermitted.vm to redirect to the logout.action, and then in login.vm to redirect to the homepage on logout.

It's a big kludge but I think it will do until we get the updated plugin you metioned.

This widget could not be displayed.

Can't they logout from Confluence and browse Anonymously?

No. They can log out okay, but as soon as they try to access any content the SSO authenticates them again and they're denied access.

This widget could not be displayed.

Yup, they will be reauthenticated and denied in an SSO environment, as there is no concept of anonymous. The only way is to use a browser that doent do the SSO, eg firefox? Thats how I worked around such stuff in the past.

Doesn't work anymore. Current Firefox version support NTLMv2.

Suggest an answer

Log in or Sign up to answer
Community showcase
Posted Sep 17, 2018 in Confluence

Why start from scratch? Introducing four new templates for Confluence Cloud

Hi my Community friends!  For those who don't know me, I'm a product marketer on the Confluence Cloud team - nice to meet you! For those of you who do, you know that I've been all up in your Co...

539 views 7 6
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you