Can a user with a disabled account browse anonymously
Asked by Andrew Cooper:

I'm running Confluence 3.5.13.

I've got SSO authentication against our Active Directory forest working using the NTLMv2 plugin from [TechTime](http://techtime.co.nz/display/TECHTIME/2011/11/01/NTLM+for+Confluence+and+Jira).

Users with an active account in Confluence are logged in automatically, and users with no account can browse spaces as anonymous. No problem here.

There is an issue, though, with users who have an account in the Confluence database which has been disabled. Whatever they try to access they get a page which says, "You are not permitted to perform this action".

My question is this: Is it possible to configure Confluence so that a person with a disabled account is able to browse as an anonymous user can?

Deleteing the user's account is not feasible due to references from content they have contributed in the past. They can log out, but as soon as they go to another page the SSO authenticates them again and they're denied access.

I think I need a way to give users with disabled accounts the "Use Confluence" global permission while maintaining their disabled status for other purposes.


Answers:
author: Ed Letifov _TechTime - New Zealand_
body: Well, my first attempt at the answer would be... ask [TechTime](http://techtime.co.nz?ans "TechTime")? Oh, wait, that's us :) Thanks for linking!

So, let's try this again...

1) It is possible to force [IOPlex](http://ioplex.com "IOPlex") Jespa (the library that actually does NTLM authenticaton under the bonnet) to install an anonymous identitiy into the session on logout. This will prevent users from getting logged in again immediately after explicit logout, but it will also remove the possibility of logging back in again by just clicking on anything outside of logout page. If you do want to go this route, just add/change this in Jespa filter definition in web.xml:

\<init-param\>  
\<param-name\>http.parameter.anonymous.name\</param-name\>  
\<param-value\>logout\</param-value\>  
\</init-param\>  
\<init-param\>  
\<param-name\>http.parameter.logout.name\</param-name\>  
\<param-value\>logout\</param-value\>  
\</init-param\>  
\<init-param\>  
\<param-name\>fallback.location\</param-name\>  
\<param-value\>/login.action?logout=true\</param-value\>  
\</init-param\>

This tells Jespa 3 things:

* if you see logout parameter in the URL, do logout.
* If you see logout parameter in the URL install anonymous identity
* if for some reason authentication fails - go to login form and install anonymous identity while you are at it

2) This specific use case is valid IMHO, disabled users should NOT be logged in into Jira/Confluence even if they pass NTLM authentication. I will add logic to handle this into our plugin. Watch this space!

comments: author: Joe Clark
body: Great tip, Ed! I've been doing Jespa installs in Confluence in my dev environments for a while now, and I never knew about this.


author: Andrew Cooper
body: Thanks Ed. That's a big help. I've added to this by putting some code in notpermitted.vm to redirect to the logout.action, and then in login.vm to redirect to the homepage on logout.

It's a big kludge but I think it will do until we get the updated plugin you metioned.


author: Andy Brook [Plugin People]
body: Yup, they will be reauthenticated and denied in an SSO environment, as there is no concept of anonymous. The only way is to use a browser that doent do the SSO, eg firefox? Thats how I worked around such stuff in the past.

comments: author: Andrew Cooper
body: Doesn't work anymore. Current Firefox version support NTLMv2.


author: Jobin Kuruvilla [Adaptavist]
body: Can't they logout from Confluence and browse Anonymously?

comments: author: Andrew Cooper
body: No. They can log out okay, but as soon as they try to access any content the SSO authenticates them again and they're denied access.


Tags: anonymous

download

sso