How to set sso in confluence ?
Asked by sunghwan lee:

We use confluence with crowd.  
We were able to log in to confluence.

We set seraph-config.xml for sso function as follows. But when I set below, can't log in to confluence.  
-------------------------------------------------------------------  
Comment out the line:-  
\<!-- \<authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/\> --\>

Uncomment the line:-  
\<authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/\>   
-------------------------------------------------------------------

Contents of below are our setting contents for sso function.

What was wrong?

?crowd  
real ip : 1.1.1.1:8095/crowd  
gateway ip : 7.7.7.7/crowd  
gateway ip's domain name : a.domain.net/crowd  
apache-tomcat/conf/server.xml : proxyName="a.domain.net"  
administrator - General - SSO Domain : [a.domain.net](http://a.domain.net)

configure application with confluence  
name : confluence  
ip : a.domain.net/confluence  
remote address : 2.2.2.2

?confluence  
real ip : <http://2.2.2.2/confluence>  
gateway ip : 7.7.7.7/confluence  
gateway ip's domain name : a.domain.net/confluence

configure directory with crowd  
server url = 1.1.1.1:8095/crowd  
application name = confluence

?apache mod_proxy for confluence  
#put this after the other LoadModule directives  
LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so  
LoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.so  
1.Put this in the main section of your configuration (or desired virtual host, if using Apache virtual hosts)  
ProxyRequests Off  
ProxyPreserveHost On  
\<Proxy \*\>  
Order deny,allow  
Allow from all  
\</Proxy\>

ProxyPass /confluence <http://2.2.2.2:8090/confluence>  
ProxyPassReverse /confluence <http://2.2.2.2:8090/confluence>  
\<Location /confluence\>  
Order allow,deny  
Allow from all  
\</Location\>

?apache mod_proxy for crowd  
#put this after the other LoadModule directives  
LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so  
LoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.so

# Put this in the main section of your configuration (or desired virtual host, if using Apache virtual hosts)  
ProxyRequests Off  
ProxyPreserveHost On

\<Proxy \*\>  
Order deny,allow  
Allow from all  
\</Proxy\>

ProxyPass /crowd <http://1.1.1.1:8095/crowd>  
ProxyPassReverse /crowd <http://1.1.1.1:8095/crowd>  
\<Location /crowd\>  
Order allow,deny  
Allow from all  
\</Location\>

?confluence - server.xml  
\<Server port="8000" shutdown="SHUTDOWN" debug="0"\>  
\<Service name="Tomcat-Standalone"\>  
\<Connector className="org.apache.coyote.tomcat4.CoyoteConnector" port="8090" minProcessors="5"  
maxProcessors="75"  
enableLookups="false" redirectPort="8443" acceptCount="10" debug="0" connectionTimeout="20000"  
useURIValidationHack="false" URIEncoding="UTF-8"/\>  
\<Engine name="Standalone" defaultHost="localhost" debug="0"\>

\<Host name="localhost" debug="0" appBase="webapps" unpackWARs="true" autoDeploy="false"\>

\<Context path="/confluence" docBase="../confluence" debug="0" reloadable="true"\>  
\<!-- Logger is deprecated in Tomcat 5.5. Logging configuration for Confluence is specified in confluence/WEB-INF/classes/log4j.properties --\>  
\<Manager pathname="" /\>  
\</Context\>  
\</Host\>

\</Engine\>

\<!--  
To run Confluence via HTTPS:

?Uncomment the Connector below  
?Execute:  
%JAVA_HOME%\\bin\\keytool -genkey -alias tomcat -keyalg RSA (Windows)  
$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA (Unix)  
with a password value of "changeit" for both the certificate and the keystore itself.  
?Restart and visit <https://localhost:8443/>  
For more info, see <http://confluence.atlassian.com/display/DOC/Adding+SSL+for+Secure+Logins+and+Page+Security>  
--\>  
\<Connector port="8090" maxHttpHeaderSize="8192"  
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"  
enableLookups="false" redirectPort="8443" acceptCount="100"  
connectionTimeout="20000" disableUploadTimeout="true"  
proxyName="[http://](http://7/)a.domain.net/" proxyPort="80"/\>  
\</Service\>  
\</Server\>

?confluence - seraph-config.xml  
\<security-config\>  
\<parameters\>  
\<init-param\>  
\<param-name\>login.url\</param-name\>  
\<param-value\>/login.action?os_destination=$

{originalurl}

\</param-value\>  
\</init-param\>  
\<init-param\>  
\<param-name\>link.login.url\</param-name\>  
\<param-value\>/login.action\</param-value\>  
\</init-param\>  
\<init-param\>  
\<param-name\>cookie.encoding\</param-name\>  
\<param-value\>cNf\</param-value\>  
\</init-param\>  
\<init-param\>  
\<param-name\>login.cookie.key\</param-name\>  
\<param-value\>seraph.confluence\</param-value\>  
\</init-param\>

\<!only basic authentication available\>  
\<init-param\>  
\<param-name\>authentication.type\</param-name\>  
\<param-value\>os_authType\</param-value\>  
\</init-param\>

\<!-- Invalidate session on login to prevent session fixation attack --\>  
\<init-param\>  
\<param-name\>invalidate.session.on.login\</param-name\>  
\<param-value\>true\</param-value\>  
\</init-param\>  
\<!-- Add names for session attributes that must not be copied to a new session when the old one gets invalidated.  
Currently it is empty (i.e. all attributes will be copied). --\>  
\<init-param\>  
\<param-name\>invalidate.session.exclude.list\</param-name\>  
\<param-value\>\</param-value\>  
\</init-param\>  
\</parameters\>

\<rolemapper class="com.atlassian.confluence.security.ConfluenceRoleMapper"/\>  
\<controller class="com.atlassian.confluence.setup.seraph.ConfluenceSecurityController"/\>

\<!-- Default Confluence authenticator, which uses the configured user management for authentication. --\>

\<!-- Custom authenticators appear below. To enable one of them, comment out the default authenticator above and uncomment the one below. --\>  
\<!-- Authenticator with support for Crowd single-sign on (SSO). --\>  
\<authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/\>  
\<!-- Specialised version of the default authenticator which adds authenticated users to confluence-users if they aren't already a member. --\>  
\<!-- \<authenticator class="com.atlassian.confluence.user.ConfluenceGroupJoiningAuthenticator"/\> --\>

\<services\>  
\<service class="com.atlassian.seraph.service.PathService"\>  
\<init-param\>  
\<param-name\>config.file\</param-name\>  
\<param-value\>seraph-paths.xml\</param-value\>  
\</init-param\>  
\</service\>  
\</services\>

\<elevatedsecurityguard class="com.atlassian.confluence.security.seraph.ConfluenceElevatedSecurityGuard"/\>

\</security-config\>

?confluence - crowd.properties

application.name confluence  
application.password \*\*\*\*  
application.login.url <http://a.domain.net/crowd/console/>

crowd.server.url [http://a.domain.net/crowd/services/](http://dpi.sec.samsung.net/crowd/services/)  
crowd.base.url [http://a.domain.net/crowd/](http://dpi.sec.samsung.net/crowd/)

session.isauthenticated session.isauthenticated  
session.tokenkey session.tokenkey  
session.validationinterval 2  
session.lastvalidation session.lastvalidation

<br />


Answers:
author: LuizA
body: Hello Sunghwann,

In a first approach I would suggest you to double-check the configuration of SSO with your Crowd version, maybe some detail about the configuration itself can be wrong (this happens), you can follow this documentation that explains how it works and how to configure:

<https://confluence.atlassian.com/display/CROWD025/Single+Sign-On>

If doesn't help I would suggest you to raise a support ticket at our [support.atlassian.com](http://support.atlassian.com) and so we can take a better look at your environment in order to find a resolution/workaround for you.

I hope this helps.

Best Regards,

LJ.


author: Sven Lecherbonnier
body: Hi Sunghwann,

What is your CROWD / Confluence ?

Regards,

Sven.

comments: author: sunghwan lee
body: Hi Sven.

crowd = 2.5.2

confluence = 4.3.2

Regards,

Sunghwan.


Tags: sso