Connecting Confluence to Jira applications for User Management

[Valeria]

Hi,
I have installed Jira software and Jira service desk on one server, then Confluence in another. I also have configured a reverse-proxy( Apache mod_proxy) that redirects to one or the other server using the Context path "/jira" and "/confluence" from the CNAME defined on my DNS. Now I would like to configure Confluence to use Jira for user management. I am following this guide, https://confluence.atlassian.com/doc/connecting-to-crowd-or-jira-for-user-management-229838465.html (case without setup wizard), I have correctly executed point 1, but I can't go on with point 2 (Set up the Jira user directory in Confluence): entering only the required fields (Name, server URL, Application Name and Application Password) and executing the test try, I get this exception:

com.atlassian.crowd.exception.ApplicationPermissionException: Forbidden (403)

In the guide, there is no reference to settings to be inserted in the case of a reverse proxy, although there are in the form to be filled to complete the configuration: proxy host, proxy port, proxy username (???????), proxy passwd(?????). In particular, for the last two parameters, I have followed the procedure to configuring the Apache mod_proxy and nowhere have I found references to creating a proxy account. Comparing with the similar procedure to be performed through the Setup Wizard, I doubt whether I should enter the credentials of the Jira admin account in the username and password fields of the proxy.   
Any suggestions to give me to complete this step?
Thank you 

[Andy Heinzer]

Hi Valeria,

I see that you are looking to connect Confluence to Jira so that you can let Jira manage the users in Confluence.  The 403 error code is a permissions failure.  It's at least a sign that the two applications are communicating with each other, just that they might not be doing so in a manner that is expected by one or both.

Thanks for including the details about using a context path and a reverse proxy.  Are you by chance serving up the content for Jira or Confluence using an HTTPS or SSL protocol?  We can still make this work either either http or https, but I just wanted to make sure that both Jira and Confluence are configured to use the same protocol type.  Mixing them (Confluence only using http while Jira only using https for example) tends to cause other problems that can't always be overcome.

I also think there might be some confusion here between the different types of proxies.  So allow me to try to briefly explain the differences in how they relate to our products. 

• Reverse proxies are web servers or loadbalance type applications that are setup in front of Jira or Confluence in order to take that incoming web traffic and then route or redirect that request to Jira/Confluence.  Common programs to do this are Apache, nginx, IIS, but you could also use a hardware unit such an F5 load balancer or alike.  
• But an Outbound proxy is different, these tend to exist in networks that want to limit the traffic or requests of clients on its network.  In those setups, you tend to need a username and password just to be able to make an http request.

It is possible that your environment might have both types of proxies, or just one or the other, but I don't clearly know that yet.  So I'm trying to write a broad answer here that I hope will encompass all possibilities.

Reverse proxy steps:

I would recommend trying to walk through the KB Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http) first to make sure that your environment is configured in a common way that we expect to use proxies with our products.   You will want to walk through that same guide twice: Once for Jira and again for Confluence.  Both applications have a server.xml file that will most likely require some adjustments to the parameters such as proxyName, proxyPort, and scheme, but also the server.xml file is where you can define path: which is used when you run either application in a context-path.   Skipping these steps could still allow you to access Jira or Confluence, but it has the potential to complicate later configurations like integrating the two products here.

Once this is done, try going to the Confluence server, and see if you can reach the Jira site URL (proxied address) in a browser.  I'm curious to see if the browser on the server is able to reach the Jira site and load this up successfully, or if it encounters any prompts/errors in the process.

Outbound proxy steps:

This would only be needed if you have an outbound proxy.   If not, skip all of this.  If you're not sure if you have one, then try going to that machine and see if you can use a browser to load an external page, like google.com or alike. 
It is possible that your network might restrict the ability for these applications to make outbound HTTP requests to each other.   If that is the case, then there are additional configuration steps that have to happen for each application to be able to communicate in those environments.  Please see How to Configure Outbound HTTP and HTTPS Proxy for your Atlassian application for more details.  It explains that there are few different JVM startup arguments you will need to define in order for Jira/confluence to be able to reach the other site successfully.

Sorry if this a lot of information here, but try checking out these different aspects first.  I'm interested to learn if these each server can make requests of the other successfully, or if there are any errors or prompts that occur in the process.

Andy