Why can't I log into Confluence with SSO enabled?

I have just set up a new test server with Confluence 6.0.7 and imported data from my existing server. This all went smoothly.

I have a Crowd directory that I use for authentication, and that also works fine... until I update the seraph configuration to enable SSO.

To be clear, I am NOT trying to log into a local account with SSO enabled; I know that doesn't work.

In the Confluence logs, I see this:

2017-04-25 19:14:25,654 WARN [http-nio-8090-exec-10] [atlassian.seraph.auth.DefaultAuthenticator] login login : 'ed.jackson' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.

However, I have debug information turned on in the Crowd logs, where I can see that it is successfully authenticating the user for the application.

Both my Confluence and Crowd servers sit in a private subnet, each behind its own proxy/load balancer. However, Confluence is configured to connect directly to Crowd on the private subnet.

I suspect the problem is one of the URLs in my crowd.properties file. What I have configured now is this:

application.name=confluence
application.password=xxxxxxxx
session.validationinterval=0
crowd.base.url=http\://crowd.internal:8095/
crowd.server.url=http\://crowd.internal:8095/services/
application.login.url=https\://wiki.mycompany.com/

To reiterate, the directory sync works fine using the same Crowd URL. Likewise, the Crowd login works fine if I don't have SSO enabled.

 

3 answers

Try adding the following to the file and restart

application.name                        confluence
application.password xxxxxxxx
application.login.url https://wiki.mycompany.com/
crowd.base.url http://crowd.internal:8095/
crowd.server.url http://crowd.internal:8095/services/
session.isauthenticated session.isauthenticated session.tokenkey session.tokenkey session.validationinterval 2 session.lastvalidation session.lastvalidation


 

Thanks, I do have all of those configured, I just omitted them for brevity.

Try like that without the forward slashes. Also I think the SSO domain has to be set in order for it to work.

https://confluence.atlassian.com/crowd/domain-17956963.html

0 vote
Bruno Vincent Community Champion Apr 26, 2017

According to that post, there might actually be something wrong with the URLs in crowd.properties.

Did you willingly change Crowd's URL? (By default this should be http://crowd.internal:8095/crowd)

You might also need to add a backslash before ":8095". Here is what you should have:

crowd.base.url=http\://crowd.internal\:8095/crowd/
crowd.server.url=http\://crowd.internal\:8095/crowd/services/

Since your environment works without SSO, you should log into Confluence's Administation UI, then select Users & Security > User Directories > Crowd Server > Edit > Server Settings and copy/paste the Server URL to your crowd.properties file (and obviously restart Confluence).

Yes, I changed the Crowd URL so it's at the root instead of at /crowd. The URL in the directory settings does exactly match the one in crowd.properties. I know it's working, because I can see in the Crowd logs that it is receiving the request from Confluence and authenticating the user.

0 vote
Ann Worley Atlassian Team Apr 27, 2017

I noticed from the log snippet that Confluence is using the default authenticator: [atlassian.seraph.auth.DefaultAuthenticator]

In <Confluence_Install>/confluence/WEB-INF/classes, please make sure the default authenticator is commented out and the SSO one is active: 

<authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/>

Thanks for that, Ann. That is in fact the active line in seraph-config.xml; I have commented out the default that uses com.atlassian.confluence.user.ConfluenceAuthenticator.

 

Suggest an answer

Log in or Sign up to answer
Atlassian Community Anniversary

Happy Anniversary, Atlassian Community!

This community is celebrating its one-year anniversary and Atlassian co-founder Mike Cannon-Brookes has all the feels.

Read more
Community showcase
Kesha Thillainayagam
Posted Apr 13, 2018 in Confluence

We want to hear how your non-technical teams are using Confluence!

Hi Community! Kesha (kay-sha) from the Confluence marketing team here! Can you share stories with us on how your non-technical (think Marketing, Sales, HR, legal, etc.) teams are using Confluen...

2,925 views 27 12
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you