Confluence HTML Include only shows login page
Asked by HaoW:

Hi community,

We are migrating Cloud to Server version and the macro HTML Include doesn't work with a page on Jira with different URL. It only shows login page on Confluence and after logged in with the correct user/password, Confluence redirected to the page on Confluence with the requested URL on Jira. Before it worked, we think the URLs are the same on Cloud for Jira and Confluence.

We are using SAML and it is still the same issue after the SAML addon was disabled. Please let me know if you run into the same issue.

Thanks,  
Hao


Answers:
author: Shannon S
body: Hao,

Thank you for reaching out! Let's see what we can find out.

Can you just help me to verify the problem? You're using the HTML include macro, but using it to refer to a page in Jira that is on a different URL. Is this correct? And the issue here is that instead of just referring to the page, it asks you to login to Jira before it can do so?

Is the Jira URL in the Application links on the Confluence instance? You use SAML for logging in on both instances?

Looking forward to hearing from you soon.

Regards,

Shannon

comments: author: HaoW
body: Shannon,

Thanks for the update. Yes, both are correct.

The JIRA URL is in application links and whiltlisted. I can use SAML to log into both instances.

Regards,  
Hao


author: Shannon S
body: Hao,

Thank you for clarifying that for me. I think that perhaps this isn't going to work properly with Jira since the HTML include macro is to display content from an HTML page within Confluence.

Could you tell me exactly what the end goal is here? I could come up with a different solution for you that would work better.

Regards,

Shannon


author: HaoW
body: Thanks Shannon for the confirmation. We would like to include a page or URL from Jira on a Confluence page. Is this doable?

Regards,

Hao


author: Shannon S
body: Hello Hao,

Thank you so much for waiting.

I've been working with my colleague on this, and we've determined the following setup should accomplish this for you:

1. Set a context path for Jira or Confluence (ideally both):
   * [How to Change the Confluence Context Path](https://confluence.atlassian.com/confkb/how-to-change-the-confluence-context-path-707985922.html)
   * [How to Change the Jira Application Context Path](https://confluence.atlassian.com/jirakb/how-to-change-the-jira-application-context-path-225119408.html)
2. Disable XSRF Security in Jira: [Security Headers in Jira](https://confluence.atlassian.com/jirakb/security-headers-in-jira-939919914.html)

One more thing, but in disabling the Clickjacking protection, it asks you to put a SET before the parameter, but in our tests, this caused issues with Jira, so you might need to leave that out.

Give it a try, and let us know how it goes.

Regards,

Shannon


author: HaoW
body: Sorry Shannon, I forgot to mention that the Jira/Confluence are residing in the different servers. Could this solution work for this case?

Thanks,  
Hao


author: Shannon S
body: Hao,

It should definitely work. If you're running through a proxy though, you might need to update it there as well.

I also wanted to mention, although it's mentioned in the document, disabling clickjacking does open yourself up to vulnerabilities, so please be aware of that!

Let me know if you run into any trouble.

Regards,

Shannon


Tags: confluence-server

server