How do we deploy Jira in a 3-tier architecture

[Misbahul Hasan]

In an internet facing deployment, we have a requirement that the authentication need to happen in the internet zone and then an authenticated request can be forward to the Jira application hosted in the core zone. This means we need to either support LDAP authentication or deploy Jira using distributed architecture where authentication happens in the internet zone and the application should be hosted in the core zone.

[Dieter · Accepted solution]

Another approach i'd recommend is to let a reverse proxy which is directly attached to the internet do the authentication against LDAP. The reverse proxy, e.g. Apache will forward the http traffic to your Jira which should be hidden behind a firewall as well as the LDAP server. Apache must be configured to pass along the name of the authenticated user in a header variable and in Jira you would need a custom authenticator to check that. how to implement this is described at http://docs.atlassian.com/atlassian-seraph/latest/sso.html By using the same reverse proxy you can easily implement a single sign on solution for all of your web applications. Also in situations of zero-day-exploits you can easily block malicious requests by simple changing a rule on the reverse proxy until there is a fix from Atlassian. There is good docu around how to configure Jira with Apache, just google for "Jira Apache"

[Dieter]

Here is information about how to configure Apache for authentication against LDAP and authorization http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html

[SimonS]

Hi M Hasan,

JIRA doesn't support a distributed tiered architecture deployments, but you can use LDAP to authenticate against JIRA:

http://confluence.atlassian.com/display/JIRADL/Integrating+JIRA+with+LDAP

-Simon