Confluence Authenticates in Plaintext?

[Matt Uebel]

When using active directory to authenticate users, is this authentication ever in plaintext?

[Tiago Comasseto · Accepted solution]

Hi Matt, are you referring to network traffic between Confluence and LDAP sending data in plaintext? If this is it, you can connect Confluence to the LDAP through SSL (as in this doc), then all communication will be encrypted.

Cheers

[Matt Uebel]

I am talking from the client perspective. User logs into Confluence web interface, client sends auth data to Confluence server.

Is this in plaintext, or is there any mechanism to protect it starting at the client side?

[Sorin Sbarnea (Citrix)]

The answer is quite simple, if not even obvious: to secure authentication you need to run Confluence on HTTPS instead of HTTP and to connect to LDAP using LDAPS.

This is more about how you configure it, not about the product itself.

[Matt Uebel]

Thank you, yes it is obvious.