SSO not working after upgrade
Asked by Dovid Bender:

Hi,

We recently upgraded our confluence install from 5.7 to 6.6.13 and SSO does not seem to be working. I made sure to update:

1)  
seraph-config.xml (as it was before. I also did a diff from my changes to the last file and the only thing I see is:  
\< \<param-value\>/login.action?os_destination=${originalurl}\&amp;permissionViolation=true\</param-value\>  
---  
\> \<param-value\>/login.action?os_destination=${originalurl}\</param-value\>  
which I think is unrelated.

2) crowd.properties (as it was before).

I know that there is communication between confluence and crowd as I added a new user to crowd called me_test. I then was able to login directly to confluence. My only issue seems to be that SSO is not working between Confluence and everything else. Meaning if I log out of everything then login in say to jira, I can get access stash without logging in again and vice versa. However even if I am already logged into jira if I go to the confluence URL I still must login again. Is there any other setting that I am missing?

What's interesting is if if I log out of confluence it will also log me out of jira, stash etc.  

EDIT: For all my applications I am using the AJP proxy with the exception of confluence which uses the mod_proxy.


Answers:
author: Edwin Kyalangalilwa
body: Hi [@Dovid Bender](/t5/user/viewprofilepage/user-id/3030611) ,

Based on [Integrating Crowd with Atlassian Confluence](https://confluence.atlassian.com/crowd/integrating-crowd-with-atlassian-confluence-198573.html)

In seraph-config.xml - you'll comment out

    <!-- <authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/> -->

and uncomment

    <authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/>

comments: author: Dovid Bender
body: [@Edwin Kyalangalilwa](/t5/user/viewprofilepage/user-id/255918) of course I tri that and it didn't work. My current config is:  

\<security-config\>  
\<parameters\>  
\<init-param\>  
\<param-name\>login.url\</param-name\>  
\<param-value\>/login.action?os_destination=${originalurl}\&amp;permissionViolation=true\</param-value\>  
\</init-param\>  
\<init-param\>  
\<param-name\>link.login.url\</param-name\>  
\<param-value\>/login.action\</param-value\>  
\</init-param\>  
\<init-param\>  
\<param-name\>cookie.encoding\</param-name\>  
\<param-value\>cNf\</param-value\>  
\</init-param\>  
\<init-param\>  
\<param-name\>login.cookie.key\</param-name\>  
\<param-value\>seraph.confluence\</param-value\>  
\</init-param\>

\<!--only basic authentication available--\>  
\<init-param\>  
\<param-name\>authentication.type\</param-name\>  
\<param-value\>os_authType\</param-value\>  
\</init-param\>  

\<!-- Invalidate session on login to prevent session fixation attack --\>  
\<init-param\>  
\<param-name\>invalidate.session.on.login\</param-name\>  
\<param-value\>true\</param-value\>  
\</init-param\>  
\<!-- Add names for session attributes that must not be copied to a new session when the old one gets invalidated.  
Currently it is empty (i.e. all attributes will be copied). --\>  
\<init-param\>  
\<param-name\>invalidate.session.exclude.list\</param-name\>  
\<param-value\>\</param-value\>  
\</init-param\>  
\</parameters\>

\<rolemapper class="com.atlassian.confluence.security.ConfluenceRoleMapper"/\>  
\<controller class="com.atlassian.confluence.setup.seraph.ConfluenceSecurityController"/\>

\<!-- Default Confluence authenticator, which uses the configured user management for authentication. --\>  
\<!-- \<authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/\> --\>

\<!-- Custom authenticators appear below. To enable one of them, comment out the default authenticator above and uncomment the one below. --\>

\<!-- Authenticator with support for Crowd single-sign on (SSO). --\>  
\<!-- Next line was enabled and line 43 was disabled by dovid bender on 2019-04-24 at 0600 so that SSO would work with the new setup --\>  
\<authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/\>

\<!-- Specialised version of the default authenticator which adds authenticated users to confluence-users if they aren't already a member. --\>  
\<!-- \<authenticator class="com.atlassian.confluence.user.ConfluenceGroupJoiningAuthenticator"/\> --\>

\<services\>  
\<service class="com.atlassian.seraph.service.PathService"\>  
\<init-param\>  
\<param-name\>config.file\</param-name\>  
\<param-value\>seraph-paths.xml\</param-value\>  
\</init-param\>  
\</service\>  
\</services\>

\<elevatedsecurityguard class="com.atlassian.confluence.security.seraph.ConfluenceElevatedSecurityGuard"/\>

\</security-config\>


author: Edwin Kyalangalilwa
body: [@Dovid Bender](/t5/user/viewprofilepage/user-id/3030611) was Confluence restarted after this change?


author: dovi5988
body: Yes . I restarted it a few times . The only thing I wonder is if the other apps are using ajp connectors and confluence is using mod proxy.


author: Dovid Bender
body: So I did some more testing. If I go to any of the other applications such as Jira, login and then go to <http://hostname.domain.org:8090> then SSO it works. It seems my issue is either in my apache config configuration OR my confluence settings for mod_proxy. Below are both. What am I doing wrong?

server.xml:

\<Server port="8000" shutdown="SHUTDOWN" debug="0"\>  
\<Service name="Tomcat-Standalone"\>  
\<!--  
\<Connector port="8090" connectionTimeout="20000" redirectPort="8443"  
maxThreads="48" minSpareThreads="10"  
enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"  
protocol="org.apache.coyote.http11.Http11NioProtocol" /\>  
--\>  
\<Engine name="Standalone" defaultHost="localhost" debug="0"\>

\<Host name="localhost" debug="0" appBase="webapps" unpackWARs="true" autoDeploy="false" startStopThreads="4"\>  
\<Context path="" docBase="../confluence" debug="0" reloadable="false" useHttpOnly="true"\>  
\<!-- Logger is deprecated in Tomcat 5.5. Logging configuration for Confluence is specified in confluence/WEB-INF/classes/log4j.properties --\>  
\<Manager pathname="" /\>  
\<Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="60" /\>  
\</Context\>

\<Context path="${confluence.context.path}/synchrony-proxy" docBase="../synchrony-proxy" debug="0" reloadable="false" useHttpOnly="true"\>  
\<Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="60" /\>  
\</Context\>  
\</Host\>

\</Engine\>

\<!--  
To run Confluence via HTTPS:  
\* Uncomment the Connector below  
\* Execute:  
%JAVA_HOME%\\bin\\keytool -genkey -alias tomcat -keyalg RSA (Windows)  
$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA (Unix)  
with a password value of "changeit" for both the certificate and the keystore itself.  
\* Restart and visit https://localhost:8443/

For more info, see <https://confluence.atlassian.com/display/DOC/Running+Confluence+Over+SSL+or+HTTPS>  
--\>  
\<!--  
\<Connector port="8443" maxHttpHeaderSize="8192"  
maxThreads="150" minSpareThreads="25"  
protocol="org.apache.coyote.http11.Http11NioProtocol"  
enableLookups="false" disableUploadTimeout="true"  
acceptCount="100" scheme="https" secure="true"  
clientAuth="false" sslProtocols="TLSv1,TLSv1.1,TLSv1.2" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" SSLEnabled="true"  
URIEncoding="UTF-8" keystorePass="\<MY_CERTIFICATE_PASSWORD\>"/\>  
--\>

\<!-- Below lines were added by dovid bender on 2019-04-23 so that mod_proxy would work --\>  
\<Connector port="8090"  
maxThreads="48"  
minSpareThreads="10"  
connectionTimeout="20000"  
enableLookups="false"  
maxHttpHeaderSize="8192"  
protocol="org.apache.coyote.http11.Http11NioProtocol"  
useBodyEncodingForURI="true"  
redirectPort="8443"  
acceptCount="10"  
disableUploadTimeout="true"  
proxyName="confluence.mydomain.org"  
proxyPort="443"  
secure="true"  
scheme="https"/\>

\</Service\>  
\</Server\>

apache config:

\<VirtualHost \*:80\>  
ServerName confluence.mydomain.org  
ServerAlias confluence.mydomain.org

RewriteEngine on  
RewriteCond %{SERVER_PORT} !\^443$  
RewriteRule \^.\*$ https://%{SERVER_NAME}%{REQUEST_URI} \[L,R\]

<br />

# Redirect / <https://confluence.mydomain.org/>

\</VirtualHost\>

\<VirtualHost \*:443\>  
ServerName confluence.mydomain.org  
ServerAlias confluence.mydomain.org

# Logging  
ErrorLog /var/log/httpd/confluence.error.log  
LogLevel info  
CustomLog /var/log/httpd/confluence.access.log combined

SSLEngine on  
SSLCertificateFile /etc/ssl/mydomain.org.crt  
SSLCertificateKeyFile /etc/ssl/mydomain.org.key  
SSLCertificateChainFile /etc/ssl/mydomain.org.ca  
#SSLCertificateChainFile /etc/ssl/mydomain.bundle  
# Proxy Settings  
ProxyRequests Off  
ProxyPreserveHost On

\<Proxy \*\>  
# Require all granted  
\</Proxy\>

ProxyPass / http://localhost:8090/  
ProxyPassReverse / http://localhost:8090/

\</VirtualHost\>


author: Dovid Bender
body: I followed <https://confluence.atlassian.com/crowd/session-configuration-17956967.html#Sessionconfiguration-screen> and un-setting "Require consistent client IP address" made it work. My question is why and is there any risk in having it unset.

<br />

TIA


author: Dovid Bender
body: BUMP


Tags: confluence-server

server