SSO for Confluence doesn't work.
Asked by Jim Logan:

We updated JIRA from 8.5.7 -- 8-18.2 and upgraded Confluence from 6-15-7 -- 7.49

Now SSO doesn't work and shows anonymous in the logs.

LOGS SHOW:

2021-09-22 11:20:49,448 WARN \[http-nio-8090-exec-11\] \[microsoft.saml.util.Util\] base64encoded MS_WARN : Before base 64 encoding::\<?xml version="1.0" encoding="UTF-8"?\>\<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" AssertionConsumerServiceURL=<https://ocioconfluence-test.doe.gov/confluence/plugins/servlet/saml/auth> Destination=<https://login.microsoftonline.com/6b183ecc-4b55-4ed5-b3f8-7f64be1c4138/saml2> ForceAuthn="false" ID="MSSSO_08238a94-91d2-44b4-aa32-47fd32127641" IsPassive="false" IssueInstant="2021-09-22T11:20:49Z" Version="2.0"\>\<saml:Issuer\>[https://ocioconfluence-test.doe.gov/confluence/\</saml:Issuer\>\</samlp:AuthnRequest](https://ocioconfluence-test.doe.gov/confluence/%3c/saml:Issuer%3e%3c/samlp:AuthnRequest)\>

-- referer: <https://ocioconfluence-test.doe.gov/confluence/login.action?errorOccured=User+is+not+available+in+Confluence.+Please+contact+your+Confluence+admin>. \| url: /confluence/plugins/servlet/saml/auth \| traceId: 982a414452bea4b5 \| userName: anonymous

2021-09-22 11:20:49,449 WARN \[http-nio-8090-exec-11\] \[microsoft.saml.util.Util\] base64encoded MS_WARN : After base 64 encoding::PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIEFzc2VydGlvbkNvbnN1bWVyU2VydmljZVVSTD0iaHR0cHM6Ly9vY2lvY29uZmx1ZW5jZS10ZXN0LmRvZS5nb3YvY29uZmx1ZW5jZS9wbHVnaW5zL3NlcnZsZXQvc2FtbC9hdXRoIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tLzZiMTgzZWNjLTRiNTUtNGVkNS1iM2Y4LTdmNjRiZTFjNDEzOC9zYW1sMiIgRm9yY2VBdXRobj0iZmFsc2UiIElEPSJNU1NTT18wODIzOGE5NC05MWQyLTQ0YjQtYWEzMi00N2ZkMzIxMjc2NDEiIElzUGFzc2l2ZT0iZmFsc2UiIElzc3VlSW5zdGFudD0iMjAyMS0wOS0yMlQxMToyMDo0OVoiIFZlcnNpb249IjIuMCI+PHNhbWw6SXNzdWVyPmh0dHBzOi8vb2Npb2NvbmZsdWVuY2UtdGVzdC5kb2UuZ292L2NvbmZsdWVuY2UvPC9zYW1sOklzc3Vlcj48L3NhbWxwOkF1dGhuUmVxdWVzdD4=

-- referer: <https://ocioconfluence-test.doe.gov/confluence/login.action?errorOccured=User+is+not+available+in+Confluence.+Please+contact+your+Confluence+admin>. \| url: /confluence/plugins/servlet/saml/auth \| traceId: 982a414452bea4b5 \| userName: anonymous

2021-09-22 11:20:49,450 WARN \[http-nio-8090-exec-11\] \[microsoft.saml.util.Util\] prepareAuthnRequest MS_WARN : Target generated is:[https://login.microsoftonline.com/6b183ecc-4b55-4ed5-b3f8-7f64be1c4138/saml2?SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIEFzc2VydGlvbkNvbnN1bWVyU2VydmljZVVSTD0iaHR0cHM6Ly9vY2lvY29uZmx1ZW5jZS10ZXN0LmRvZS5nb3YvY29uZmx1ZW5jZS9wbHVnaW5zL3NlcnZsZXQvc2FtbC9hdXRoIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29...](https://login.microsoftonline.com/6b183ecc-4b55-4ed5-b3f8-7f64be1c4138/saml2?SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIEFzc2VydGlvbkNvbnN1bWVyU2VydmljZVVSTD0iaHR0cHM6Ly9vY2lvY29uZmx1ZW5jZS10ZXN0LmRvZS5nb3YvY29uZmx1ZW5jZS9wbHVnaW5zL3NlcnZsZXQvc2FtbC9hdXRoIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tLzZiMTgzZWNjLTRiNTUtNGVkNS1iM2Y4LTdmNjRiZTFjNDEzOC9zYW1sMiIgRm9yY2VBdXRobj0iZmFsc2UiIElEPSJNU1NTT18wODIzOGE5NC05MWQyLTQ0YjQtYWEzMi00N2ZkMzIxMjc2NDEiIElzUGFzc2l2ZT0iZmFsc2UiIElzc3VlSW5zdGFudD0iMjAyMS0wOS0yMlQxMToyMDo0OVoiIFZlcnNpb249IjIuMCI+PHNhbWw6SXNzdWVyPmh0dHBzOi8vb2Npb2NvbmZsdWVuY2UtdGVzdC5kb2UuZ292L2NvbmZsdWVuY2UvPC9zYW1sOklzc3Vlcj48L3NhbWxwOkF1dGhuUmVxdWVzdD4=)

-- referer: <https://ocioconfluence-test.doe.gov/confluence/login.action?errorOccured=User+is+not+available+in+Confluence.+Please+contact+your+Confluence+admin>. \| url: /confluence/plugins/servlet/saml/auth \| traceId: 982a414452bea4b5 \| userName: anonymous

2021-09-22 11:20:49,969 ERROR \[http-nio-8090-exec-7\] \[microsoft.saml.util.SignatureValidator\] validate MS_INFO : SignatureValidator started to validate signature tags

-- referer: <https://login.microsoftonline.com/> \| url: /confluence/plugins/servlet/saml/auth \| traceId: b5944bc2aaab2de4 \| userName: anonymous

2021-09-22 11:20:49,971 ERROR \[http-nio-8090-exec-7\] \[microsoft.saml.util.SignatureValidator\] validate MS_INFO : SignatureValidator Completed validation of signature tags

-- referer: <https://login.microsoftonline.com/> \| url: /confluence/plugins/servlet/saml/auth \| traceId: b5944bc2aaab2de4 \| userName: anonymous

2021-09-22 11:20:49,972 WARN \[http-nio-8090-exec-7\] \[microsoft.saml.util.XMLUtility\] validateSignNode MS_WARN : certificate found in signature

-- referer: <https://login.microsoftonline.com/> \| url: /confluence/plugins/servlet/saml/auth \| traceId: b5944bc2aaab2de4 \| userName: anonymous

2021-09-22 11:20:49,976 ERROR \[http-nio-8090-exec-7\] \[atlassianplugin.confluence.servlet.ConfluenceSSOLoginServlet\] authenticateUserAndLogin MS_ERROR : User is not available in Confluence. Please contact your Confluence admin :6GM2SDgs8w4-etWa9iB8BDoSv4SfA-qbtr2D3P1L330

-- referer: <https://login.microsoftonline.com/> \| url: /confluence/plugins/servlet/saml/auth \| traceId: b5944bc2aaab2de4 \| userName: anonymous

2021-09-22 11:20:49,983 ERROR \[http-nio-8090-exec-7\] \[microsoft.atlassianplugin.applicationinsight.ApplicationInsightUtil\] logException MS_ERROR : Exception message = User is not available in Confluence. Please contact your Confluence admin.

tenantID = 6b183ecc-4b55-4ed5-b3f8-7f64be1c4138

appID = 9cb91197-9d25-4067-9fc8-b131e1b6e5f8

userID = 6GM2SDgs8w4-etWa9iB8BDoSv4SfA-qbtr2D3P1L330

-- referer: <https://login.microsoftonline.com/> \| url: /confluence/plugins/servlet/saml/auth \| traceId: b5944bc2aaab2de4 \| userName: anonymous


Answers:
author: Kishan Sharma
body: thanks for the details. If you perform Quick Test, what results do you get ? just to make sure that the username/password is correct so that sync can work.

comments: author: Jim Logan
body: Test Remote Directory Connection  
Test Remote Directory Connection  
Use this form to test the connection to Atlassian Crowd directory 'Remote JIRA Directory'.

For extended testing enter the credentials of a user in the remote directory.

Test basic connection : Succeeded  
Test retrieve user : Succeeded  
Test user rename is configured and tracked : The Unique ID Attribute has been left blank. We recommend you set this to the attribute for the UUID of the user.  
Test get user's memberships : Succeeded, 9 groups retrieved  
Test retrieve group : Succeeded  
Test get group members : Succeeded, 19 users retrieved  
Test user can authenticate : Not performed  
User name  
james.logan  
Password  
??????????????????????????  
Back to directory list


author: Kishan Sharma
body: Great, so you have got this working now already ?


author: Kishan Sharma
body: Hi [@Jim Logan](/t5/user/viewprofilepage/user-id/4073932) The error says "*User is not available in Confluence.*" Have you verified if the user exists in the confluence user directory ? It's not working for all users or just few users ?

comments: author: Jim Logan
body: Hi [@Kishan Sharma](/t5/user/viewprofilepage/user-id/554991) ,

The users exist in the confluence directory and it works for me and nobody else.


author: Kishan Sharma
body: Thanks for confirming Jim. If you go to User directories, can you test the directory sync ? when was it last successful ?


author: Jim Logan
body: - Test user rename is configured and tracked : The Unique ID Attribute has been left blank. We recommend you set this to the attribute for the UUID of the user.

- Test user can authenticate : Not performed


author: Jim Logan
body: === Current user ===  
Directory ID: 294913  
Username: james.logan  
Display name: Jim Logan  
Email address: james.logan@hq.doe.gov

=== Directories configured ===  
Directory ID: 294914  
Name: Confluence Internal Directory  
Active: true  
Type: INTERNAL  
Created date: 2018-07-18 11:54:33.151  
Updated date: 2018-07-18 11:54:33.151  
Allowed operations: \[CREATE_USER, DELETE_GROUP, UPDATE_USER_ATTRIBUTE, CREATE_ROLE, CREATE_GROUP, UPDATE_ROLE, UPDATE_ROLE_ATTRIBUTE, DELETE_ROLE, UPDATE_GROUP_ATTRIBUTE, DELETE_USER, UPDATE_GROUP, UPDATE_USER\]  
Implementation class: com.atlassian.crowd.directory.InternalDirectory  
Encryption type: atlassian-security  
Attributes:  
"user_encryption_method": "atlassian-security"

Directory ID: 294913  
Name: Remote JIRA Directory  
Active: true  
Type: CROWD  
Created date: 2018-07-18 11:54:32.978  
Updated date: Fri Sep 24 15:01:18 EDT 2021  
Allowed operations: \[CREATE_USER, DELETE_GROUP, UPDATE_USER_ATTRIBUTE, UPDATE_ROLE_ATTRIBUTE, CREATE_GROUP, UPDATE_ROLE, CREATE_ROLE, DELETE_ROLE, UPDATE_GROUP_ATTRIBUTE, DELETE_USER, UPDATE_GROUP, UPDATE_USER\]  
Implementation class: com.atlassian.crowd.directory.RemoteCrowdDirectory  
Encryption type: null  
Attributes:  
"application.name": "Confluence - ocioconfluence.doe.gov - d9687ab7-6f4d-3b28-8ebb-29c4d7981a8c"  
"application.password": \*\*\*\*\*\*\*\*  
"com.atlassian.crowd.directory.sync.cache.enabled": "true"  
"com.atlassian.crowd.directory.sync.issynchronising": "false"  
"com.atlassian.crowd.directory.sync.lastdurationms": "946"  
"com.atlassian.crowd.directory.sync.laststartsynctime": "1632510077604"  
"crowd.server.http.max.connections": "20"  
"crowd.server.http.timeout": "5000"  
"crowd.server.url": "<http://ocioconfluence-test.doe.gov:8080/jira>"  
"crowd.sync.group.membership.after.successful.user.auth.enabled": "true"  
"crowd.sync.incremental.enabled": "false"  
"directory.cache.synchronise.interval": "3600"  
"useNestedGroups": "true"


author: Jim Logan
body: ### Current Settings {#toc-hId-1283033935}

Initial Pool Size:1  
Preferred Pool Size:10  
Maximum Pool Size:0  
Pool Timeout (seconds):30  
Pool Protocol:plain ssl  
Pool Authentication:simple

### Update Settings {#toc-hId--524420528}

Initial Pool Size:  
Number of connections to create when initially connecting to the pool.  
Preferred Pool Size:  
Idle connections will be removed from the pool if the pool is larger than the preferred size.  
Maximum Pool Size:  
Maximum number of connections to the LDAP server. Value of 0 means no maximum. Note that requests will block if there is no available connection.  
Pool Timeout (seconds):  
Idle time for a connection before it is removed from the pool. Value of 0 means there is no timeout.  
Pool Protocol:  
Space-separated list of protocols for which connections will be pooled. Valid types are: plain, ssl.  
Pool Authentication:


Tags: confluence-server

server