It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Why can't I log into Confluence with SSO enabled?

Ed Jackson Apr 25, 2017

I have just set up a new test server with Confluence 6.0.7 and imported data from my existing server. This all went smoothly.

I have a Crowd directory that I use for authentication, and that also works fine... until I update the seraph configuration to enable SSO.

To be clear, I am NOT trying to log into a local account with SSO enabled; I know that doesn't work.

In the Confluence logs, I see this:

2017-04-25 19:14:25,654 WARN [http-nio-8090-exec-10] [atlassian.seraph.auth.DefaultAuthenticator] login login : 'ed.jackson' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.

However, I have debug information turned on in the Crowd logs, where I can see that it is successfully authenticating the user for the application.

Both my Confluence and Crowd servers sit in a private subnet, each behind its own proxy/load balancer. However, Confluence is configured to connect directly to Crowd on the private subnet.

I suspect the problem is one of the URLs in my crowd.properties file. What I have configured now is this:

application.name=confluence
application.password=xxxxxxxx
session.validationinterval=0
crowd.base.url=http\://crowd.internal:8095/
crowd.server.url=http\://crowd.internal:8095/services/
application.login.url=https\://wiki.mycompany.com/

To reiterate, the directory sync works fine using the same Crowd URL. Likewise, the Crowd login works fine if I don't have SSO enabled.

 

3 answers

0 votes
Edwin Kyalangalilwa Community Leader Apr 25, 2017 • edited Apr 26, 2017

Try adding the following to the file and restart

application.name                        confluence
application.password xxxxxxxx
application.login.url https://wiki.mycompany.com/
crowd.base.url http://crowd.internal:8095/
crowd.server.url http://crowd.internal:8095/services/
session.isauthenticated session.isauthenticated session.tokenkey session.tokenkey session.validationinterval 2 session.lastvalidation session.lastvalidation


 

Ed Jackson Apr 26, 2017

Thanks, I do have all of those configured, I just omitted them for brevity.

Edwin Kyalangalilwa Community Leader Apr 26, 2017 • edited

Try like that without the forward slashes. Also I think the SSO domain has to be set in order for it to work.

https://confluence.atlassian.com/crowd/domain-17956963.html

0 votes
Bruno Vincent Community Leader Apr 26, 2017

According to that post, there might actually be something wrong with the URLs in crowd.properties.

Did you willingly change Crowd's URL? (By default this should be http://crowd.internal:8095/crowd)

You might also need to add a backslash before ":8095". Here is what you should have:

crowd.base.url=http\://crowd.internal\:8095/crowd/
crowd.server.url=http\://crowd.internal\:8095/crowd/services/

Since your environment works without SSO, you should log into Confluence's Administation UI, then select Users & Security > User Directories > Crowd Server > Edit > Server Settings and copy/paste the Server URL to your crowd.properties file (and obviously restart Confluence).

Ed Jackson Apr 26, 2017

Yes, I changed the Crowd URL so it's at the root instead of at /crowd. The URL in the directory settings does exactly match the one in crowd.properties. I know it's working, because I can see in the Crowd logs that it is receiving the request from Confluence and authenticating the user.

0 votes
Ann Worley Atlassian Team Apr 27, 2017

I noticed from the log snippet that Confluence is using the default authenticator: [atlassian.seraph.auth.DefaultAuthenticator]

In <Confluence_Install>/confluence/WEB-INF/classes, please make sure the default authenticator is commented out and the SSO one is active: 

<authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/>
Ed Jackson Apr 28, 2017

Thanks for that, Ann. That is in fact the active line in seraph-config.xml; I have commented out the default that uses com.atlassian.confluence.user.ConfluenceAuthenticator.

 

Suggest an answer

Log in or Sign up to answer
This widget could not be displayed.
This widget could not be displayed.
Community showcase
Published in Confluence

Confluence CVEs and common questions

Two vulnerabilities have been published for Confluence Server and Data Center recently: March 20, 2019 CVE-2019-3395 / CVE-2019-3396 April 17, 2019 CVE-2019-3398 The goal of this article is...

950 views 0 19
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you