I have just set up a new test server with Confluence 6.0.7 and imported data from my existing server. This all went smoothly.
I have a Crowd directory that I use for authentication, and that also works fine... until I update the seraph configuration to enable SSO.
To be clear, I am NOT trying to log into a local account with SSO enabled; I know that doesn't work.
In the Confluence logs, I see this:
2017-04-25 19:14:25,654 WARN [http-nio-8090-exec-10] [atlassian.seraph.auth.DefaultAuthenticator] login login : 'ed.jackson' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.
However, I have debug information turned on in the Crowd logs, where I can see that it is successfully authenticating the user for the application.
Both my Confluence and Crowd servers sit in a private subnet, each behind its own proxy/load balancer. However, Confluence is configured to connect directly to Crowd on the private subnet.
I suspect the problem is one of the URLs in my crowd.properties file. What I have configured now is this:
application.name=confluence application.password=xxxxxxxx session.validationinterval=0 crowd.base.url=http\://crowd.internal:8095/ crowd.server.url=http\://crowd.internal:8095/services/ application.login.url=https\://wiki.mycompany.com/
To reiterate, the directory sync works fine using the same Crowd URL. Likewise, the Crowd login works fine if I don't have SSO enabled.
Try adding the following to the file and restart
session.isauthenticated session.isauthenticated session.tokenkey session.tokenkey session.validationinterval 2 session.lastvalidation session.lastvalidation
According to that post, there might actually be something wrong with the URLs in crowd.properties.
Did you willingly change Crowd's URL? (By default this should be http://crowd.internal:8095/crowd)
You might also need to add a backslash before ":8095". Here is what you should have:
Since your environment works without SSO, you should log into Confluence's Administation UI, then select Users & Security > User Directories > Crowd Server > Edit > Server Settings and copy/paste the Server URL to your crowd.properties file (and obviously restart Confluence).
Yes, I changed the Crowd URL so it's at the root instead of at /crowd. The URL in the directory settings does exactly match the one in crowd.properties. I know it's working, because I can see in the Crowd logs that it is receiving the request from Confluence and authenticating the user.
I noticed from the log snippet that Confluence is using the default authenticator: [atlassian.seraph.auth.DefaultAuthenticator]
In <Confluence_Install>/confluence/WEB-INF/classes, please make sure the default authenticator is commented out and the SSO one is active:
Two vulnerabilities have been published for Confluence Server and Data Center recently: March 20, 2019 CVE-2019-3395 / CVE-2019-3396 April 17, 2019 CVE-2019-3398 The goal of this article is...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events