Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Next challenges

Recent achievements

  • Global
  • Personal

Recognition

  • Give kudos
  • Received
  • Given

Leaderboard

  • Global

Trophy case

Kudos (beta program)

Kudos logo

You've been invited into the Kudos (beta program) private group. Chat with others in the program, or give feedback to Atlassian.

View group

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Workaround to Effect Client Certificate-Based (Passwordless) Authentication to Confluence? Edited

I am aware that Confluence / Crowd does not currently  directly support Client Certificate-based authentication to Confluence via PKI, per this discussion.  As any such support remains a distant and uncertain prospect, I am wondering whether there are alternate, more convoluted means to achieve the same result. 

Specifically,  is there  a way to use client certificates to authenticate to an (Open) LDAP service, and then have the service broker authentication to Confluence over Crowd (which seems to support LDAP), with client certificates being used for the entire process from the perspective of user (i.e. user is never prompted for/enters a password directly)?

2 answers

I believe you can achieve what you are after by deploying a reverse proxy in front of the Atlassian application, configured to perform the client certificate-based authentication and then pass the extracted Subject to the Atlassian application as HTTP header value. We have customers who are using F5 appliances in front of their applications to do just this.

To stay secure, the proxy and the service must be configured in a way that it would be impossible to set this header from "outside" circumventing the proxy i.e. no direct access allowed, and the proxy must clear this header on the requests from outside.

You can then use our EasySSO for Confluence app on the Atlassian application side, to take the username from the header, or apply some custom decoding code before that happens.

Please feel free to reach to our 24x7 support if you require more details.

Yeah I have a reverse proxy deployed already - I'll check out the EasySSO appliance in the next few days, thanks!

0 votes

I don't know the answer to this myself but someone from the TechTime team will know. I'll follow up on Monday.

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Posted in Confluence

What do you think is the most *delightful* Confluence feature? Comment for a prize!

- Create your own custom emoji 🔥 - "Shake for Feedback" on mobile 📱 - An endless supply of GIFs via GIPHY 🤩 Is there anything quite as nice as a pleasant surprise? Comment below with what...

480 views 24 9
Join discussion

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you