/confluence-remote-user-sso

Biel Bienne confluence Remote User Single Sign On Authenticator: Authenticating to confluence with the X_Forwarded_User HTTP header

Primary LanguageJavaGNU Lesser General Public License v2.1LGPL-2.1

Confluence plugin for http header authentication (SSO / Kerberos)

This plugin provides authentication based on a http header (default: X_Forwarded_User). The authenticator will fall back to the default Confluence authenticator, so everything external should keep working as expected.

License

This software is distributed under the GNU Lesser General Public License 2.1. See COPYING for details.

Install

There are a few things you need in order to install this plugin:

  • Get the Atlassian SDK as described at Atlassian
  • Build the .jar file with the atlas-package command in the root folder (containing the pom.xml)
  • Stop your Confluence instance if it is running
  • Copy the target/russo-confluence-1.0.jar file to the WEB-INF/libs folder of your Confluence installation
  • Modify the WEB-INF/classes/seraph-config.xml file by commenting out existing auth classes and adding <authenticator class="ch.bielbienne.confluence.BielBienneConfluenceAuthenticator"/>
  • Restart your Confluence instance
  • If it doesn't work as expected, check your Confluence logs. If you need more verbose information, set useDebug to true and recompile and reinstall the package

Configuring your httpd

In order to get it to work, you need to configure your httpd (e.g. Apache httpd) to do the authentication and set the header. For security reasons you should make sure that user-set headers are removed, otherwise users will be able to spoof authentication and log in as a different user!

Example Apache configuration

<VirtualHost *:443>
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/mypubliccert.pem
SSLCertificateKeyFile /etc/pki/tls/private/privatekey.pem
ProxyPreserveHost On
ProxyRequests Off
ServerName wiki.mycompany.tld
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
SSLProxyEngine On

    <Location />
        AuthType Kerberos
        AuthName "Confluence Kerberos Auth"
        KrbMethodNegotiate On
        KrbMethodK5Passwd On
        KrbAuthRealms MYREALM
        Krb5KeyTab /etc/httpd/httpd.keytab
        KrbLocalUserMapping On
        require valid-user
        RequestHeader set X-Forwarded-User %{REMOTE_USER}s
    </Location>
</VirtualHost>