I have just set up a new test server with Confluence 6.0.7 and imported data from my existing server. This all went smoothly.
I have a Crowd directory that I use for authentication, and that also works fine... until I update the seraph configuration to enable SSO.
To be clear, I am NOT trying to log into a local account with SSO enabled; I know that doesn't work.
In the Confluence logs, I see this:
2017-04-25 19:14:25,654 WARN [http-nio-8090-exec-10] [atlassian.seraph.auth.DefaultAuthenticator] login login : 'ed.jackson' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.
However, I have debug information turned on in the Crowd logs, where I can see that it is successfully authenticating the user for the application.
Both my Confluence and Crowd servers sit in a private subnet, each behind its own proxy/load balancer. However, Confluence is configured to connect directly to Crowd on the private subnet.
I suspect the problem is one of the URLs in my crowd.properties file. What I have configured now is this:
application.name=confluence application.password=xxxxxxxx session.validationinterval=0 crowd.base.url=http\://crowd.internal:8095/ crowd.server.url=http\://crowd.internal:8095/services/ application.login.url=https\://wiki.mycompany.com/
To reiterate, the directory sync works fine using the same Crowd URL. Likewise, the Crowd login works fine if I don't have SSO enabled.
Try adding the following to the file and restart
session.isauthenticated session.isauthenticated session.tokenkey session.tokenkey session.validationinterval 2 session.lastvalidation session.lastvalidation
According to that post, there might actually be something wrong with the URLs in crowd.properties.
Did you willingly change Crowd's URL? (By default this should be http://crowd.internal:8095/crowd)
You might also need to add a backslash before ":8095". Here is what you should have:
Since your environment works without SSO, you should log into Confluence's Administation UI, then select Users & Security > User Directories > Crowd Server > Edit > Server Settings and copy/paste the Server URL to your crowd.properties file (and obviously restart Confluence).
Yes, I changed the Crowd URL so it's at the root instead of at /crowd. The URL in the directory settings does exactly match the one in crowd.properties. I know it's working, because I can see in the Crowd logs that it is receiving the request from Confluence and authenticating the user.
I noticed from the log snippet that Confluence is using the default authenticator: [atlassian.seraph.auth.DefaultAuthenticator]
In <Confluence_Install>/confluence/WEB-INF/classes, please make sure the default authenticator is commented out and the SSO one is active:
Hi team, I’m Avinoam, a product manager on Confluence Cloud, and today I’m really excited to let the Community know that all customers can now try out the new editing experience and see some of the ...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs