Problems with Crowd token validation when Confluence is sitting behind an Apache proxy.

We have Confluence sitting behind an Apache proxy running on the same host:

<Location / >
        ProxyPass          http://127.0.0.1:8080/
        ProxyPassReverse   http://127.0.0.1:8080/
</Location>

When Confluence attempts to validate a Crowd SSO token, it sets the remote-address validation-factor to "127.0.0.1", like this:

<validation-factors>
    <validation-factor>
        <name>remote_address</name>
        <value>127.0.0.1</value>
    </validation-factor>
    <validation-factor>
        <name>X-Forwarded-For</name>
        <value>96.1.2.3, 96.1.2.3</value>
    </validation-factor>
</validation-factors>

Here, the actual remote client is 96.1.2.3. The client connects to Crowd and to Confluence through a front-end proxy; the request arriving at Crowd has these headers:

X-Forwarded-For: 10.243.22.47, 10.243.21.54

Where 10.243.22.47 is the address of the Confluence host. The requests received by Apache on the Confluence host look like this:

X-Forwarded-For: 96.1.2.3

And when the request gets received by Tomcat, it looks like this:

X-Forwarded-For: 96.1.2.3, 96.1.2.3

Is there any way to get this to work? If I understand how things are working (and I may not!), Crowd and Confluence can only do SSO successfully if Confluence is receiving requests directly from clients -- i.e., with no intervening proxies. Is there any way to get Confluence to use the correct remote-address?

3 answers

I have. You'll note that Confluence is able to authenticate to Crowd despite talking through a proxy; the problem here is that Confluence is providing bad information to Crowd, so no amount of trust is going to solve it. If there were something in Confluence analagous to "trusted proxies" so that Confluence would get the remote-address value from the X-Forwarded-For header that would solve our problem.

To elaborated a bit: we have configured trusted proxies in Crowd, and the validation request is being passwd to the Crowd server by Confluence via one of our trusted proxies.

This page has hepled me in the past: http://confluence.atlassian.com/display/CROWD/Debugging+SSO+in+environments+with+Proxy+Servers

You can find the remote ips using this method.Ignore if you have tried this as well ;)

Did you ever figure out a solution to this issue? We are facing a similar problem to you and have reached a standstill in solving it.

Hi, what list of ips do you have on Crowd's listed of authentication interfaces for the application Confluence? Have you added 127.0.0.1 and the other localhost options?

Suggest an answer

Log in or Sign up to answer
How to earn badges on the Atlassian Community

How to earn badges on the Atlassian Community

Badges are a great way to show off community activity, whether you’re a newbie or a Champion.

Learn more
Community showcase
Published 5 hours ago in Confluence

Three common content challenges + how to manage them

An efficient enterprise content management system, or ECM, is a must-have for companies that create work online (cough   cough, all companies). If content calendars, marketing plans, and bu...

18 views 0 3
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you