Why can't I log into Confluence with SSO enabled?
Asked by Ed Jackson:

I have just set up a new test server with Confluence 6.0.7 and imported data from my existing server. This all went smoothly.

I have a Crowd directory that I use for authentication, and that also works fine... until I update the seraph configuration to enable SSO.

To be clear, I am NOT trying to log into a local account with SSO enabled; I know that doesn't work.

In the Confluence logs, I see this:

```
2017-04-25 19:14:25,654 WARN [http-nio-8090-exec-10] [atlassian.seraph.auth.DefaultAuthenticator] login login : 'ed.jackson' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.
```

However, I have debug information turned on in the Crowd logs, where I can see that it is successfully authenticating the user for the application.

Both my Confluence and Crowd servers sit in a private subnet, each behind its own proxy/load balancer. However, Confluence is configured to connect directly to Crowd on the private subnet.

I suspect the problem is one of the URLs in my crowd.properties file. What I have configured now is this:

```
application.name=confluenceapplication.password=xxxxxxxxsession.validationinterval=0crowd.base.url=http\://crowd.internal:8095/crowd.server.url=http\://crowd.internal:8095/services/application.login.url=https\://wiki.mycompany.com/
```

To reiterate, the directory sync works fine using the same Crowd URL. Likewise, the Crowd login works fine if I don't have SSO enabled.


Answers:
author: AnnWorley
body: I noticed from the log snippet that Confluence is using the default authenticator: \[atlassian.seraph.auth.DefaultAuthenticator\]

In \<Confluence_Install\>/confluence/WEB-INF/classes, please make sure the default authenticator is commented out and the SSO one is active:

```
<authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/>
```

comments: author: Ed Jackson
body: Thanks for that, Ann. That is in fact the active line in seraph-config.xml; I have commented out the default that uses com.atlassian.confluence.user.ConfluenceAuthenticator.


author: Bruno Vincent
body: According to [that post](/t5/Confluence-questions/SSO-not-working/qaq-p/247572), there might actually be something wrong with the URLs in *crowd.properties*.

Did you willingly change Crowd's URL? (By default this should be <http://crowd.internal:8095/crowd>)

You might also need to add a backslash before ":8095". Here is what you should have:

```
crowd.base.url=http\://crowd.internal\:8095/crowd/crowd.server.url=http\://crowd.internal\:8095/crowd/services/
```

Since your environment works without SSO, you should log into Confluence's Administation UI, then select *Users \& Security \> User Directories \> Crowd Server \> Edit \> Server Settings* and copy/paste the Server URL to your *crowd.properties* file (and obviously restart Confluence).

comments: author: Ed Jackson
body: Yes, I changed the Crowd URL so it's at the root instead of at /crowd. The URL in the directory settings does exactly match the one in crowd.properties. I know it's working, because I can see in the Crowd logs that it is receiving the request from Confluence and authenticating the user.


author: Edwin Kyalangalilwa
body: Try adding the following to the file and restart

```
application.name                        confluence
application.password                    xxxxxxxx
application.login.url                   https://wiki.mycompany.com/
crowd.base.url                          http://crowd.internal:8095/
crowd.server.url                        http://crowd.internal:8095/services/
session.isauthenticated                 session.isauthenticatedsession.tokenkey                        session.tokenkeysession.validationinterval              2session.lastvalidation                  session.lastvalidation


```

comments: author: Ed Jackson
body: Thanks, I do have all of those configured, I just omitted them for brevity.


author: Edwin Kyalangalilwa
body: Try like that without the forward slashes. Also I think the SSO domain has to be set in order for it to work.

<https://confluence.atlassian.com/crowd/domain-17956963.html>


Tags: confluence-administration

crowd