I want to automatically login to Confluence with a fixed user/password? So not using SSO and not using anonymous.
Asked by Karin Heijboer:

Currently we are developing a cloud application. We would like to use Confluence Cloud for creating help pages for our own cloud application. We would like to create 2 spaces in Confluence. 1 space with internal documentation, user login is required for this space. The other space will contain the help text for our cloud application. Users that are logged on to our cloud application need read only access to this help space and are allowed to see everything in this space. But we do not want our help pages to be visible publicly from the internet. We do not want the users from our cloud application to have to login to be able to view the help text. But if we use anonymous login, then the space is visible to the world, which we do not want. Is it possible to create a generic help_user with read access to the entire Help space, and use a simple API to automatically login to confluence from our cloud application? A SSO solution is to complex. We do not want to have to setup a new user on confluence, every time our customers add a new user in our cloud application.


Answers:
author: Dario B
body: You can try to use Oauth as explained in below tutorial:

* <https://developer.atlassian.com/jiradev/jira-apis/jira-rest-apis/jira-rest-api-tutorials/jira-rest-api-example-oauth-authentication>

Otherwise you can also use basic authentication or Cookie authentication (but this last one is at the moment affected by a bug tracked in: <https://jira.atlassian.com/browse/JRA-63867> in this case you can use basic auth, intercept the cookie and then use it to authenticate the subsequent requests):

* <https://developer.atlassian.com/jiradev/jira-apis/jira-rest-apis/jira-rest-api-tutorials/jira-rest-api-example-basic-authentication>
* <https://developer.atlassian.com/jiradev/jira-apis/jira-rest-apis/jira-rest-api-tutorials/jira-rest-api-example-cookie-based-authentication>

\\\\  
Best Regards,  
Dario  
Atlassian Cloud Support

comments: author: Vivek Shanmughan
body: How can i use the cookie from the basic authentication to authenticate the future requests?

here is the response i received in my back end from confluence

curl -D- -u test:test123 -X GET -H "Content-Type: application/json" <http://172.18.20.8:9090/rest/api/2/issue/createmeta>  
HTTP/1.1 404  
X-ASEN: SEN-L12887861  
Set-Cookie: JSESSIONID=E93E362BD9F2CEA1922ABA486D130BAD; Path=/; HttpOnly  
X-Seraph-LoginReason: OK  
X-AUSERNAME: test  
Cache-Control: no-transform  
X-Content-Type-Options: nosniff  
Vary: Accept  
Content-Type: application/xml  
Content-Length: 186  
Date: Fri, 04 Jan 2019 17:55:51 GMT

How can i use this cookie to authenticate and launch a confluence url accessible to the user "test"?


author: Dario B
body: [@Vivek Shanmughan](/t5/user/viewprofilepage/user-id/2507145),

Please follow the instructions in below documentation:

* <https://developer.atlassian.com/server/jira/platform/cookie-based-authentication/>


author: Andrea Chiericati
body: Hi [@Dario B](/t5/user/viewprofilepage/user-id/502402)

the instructions has been [deprecated](https://developer.atlassian.com/cloud/jira/platform/deprecation-notice-basic-auth-and-cookie-based-auth/), other options?

[@Karin Heijboer](/t5/user/viewprofilepage/user-id/585105) did you solve your issue?  
I have the same need


author: Decideware Admin
body: I have the exact same problem, we used to pass the username and password as part of the URL (not ideal I know) but now that method of authentication has been forbidden by Atlassian. What's the alternative?


author: Robert Massaioli _Atlassian_
body: Have you considered using Atlassian Connect to build a tight integration and solve this problem: [connect.atlassian.com](http://connect.atlassian.com) ?


author: Rodney Hughes
body: your generic help_user will not help them - then they have to sign on either as themselves or as the help_user and then the generic help_user effectively becomes anonymous access as there is no prevention of the User remembering their log in after they leave your client's company, or posting it on facebook or wiki-leaks ...

Making sure each User has their own account ensures you have control over revoking their access when needed and gives them a sense of "confidentiality" and the "prestige" of being a trusted person - it is worth it!

The simple answer is grant your Users access to the two Spaces on the Cloud instance - they would only have view access to pages in the "Help Space".

One way of doing that is giving the Help Space access to the group "All Confluence Users" so every new User automatically is included in that group.


Tags: cloud

confluence-cloud