...
Below is the recipe for getting this to work with Ubuntu 12.04, Confluence 5.1.1, Apache, and modmellonmod_auth_mellon.
I choose modmellon because it seemed like a cleaner solution than mod_shib, requiring no additional daemons and much simpler configuration.
The wiki will be open to the public, and logins will only be federated. New users will have their account automatically created, and are put in the confluence-users group.
Prerequisites
Before you start, make sure you have these bits:
...
- A correctly configured apache web server that is able to serve an HTTPS web site (https://example.com).
- A SAML Identity Provider (IdP).
- An account on that IdP.
- An attribute that can be used as username in Confluence (for example eduPersonPrincipalName). Attributes for full name and e-mail are optional but recommended. In this case we assume 'mail' and 'displayName' can be used.
- The user name of the to-be administrator account. So, if you choose eduPersonPrincipalName as the attribute for username, you need to know your own value (for instance 'dvisser@surfnet.nl').
PostgreSQL
| Code Block |
|---|
apt-get install postgresql |
...
Edit confluence/WEB-INF/classes/confluence-init.properties and configure confluence.home=/home/confluence.
Upstart script for Confluence
Ubuntu uses the new upstart init scripts, which we should use.
...
Modmellon
mod_auth_mellon
mod_auth_mellon Modmellon is an Apache module. To get this working I recompiled the Debian source packages from the University of Tilburg for Ubuntu 12.04 and made them available in our own APT repository. Ubuntu 14.04 and later have the module available as well.
Once that is done, the needed packages can be installed:
...
And once that is done, you should be able to use federated authentication by going to https://example.com/mellon/login?ReturnTo=%2F
Confluence - part 2
Now everything is in place to federate Confluence. Make sure that Confluence isn't running any more.
...
You should now be able to use federated logins.
Confluence - mobile theme
The new Confluence feature a dedicated theme for use on mobile devices. This is great, but unfortunately both the login and logout buttons in that theme do not work - they still point to the 'old' static login/logout links.
Login button
I couldn't find any way to do this in Confluence, so I ended up rewriting it in Apache. See the snippet in the Apache config above.
Logout button
...
| Code Block | ||
|---|---|---|
| ||
<action name="logout" class="com.atlassian.confluence.user.actions.LogoutAction">
<interceptor-ref name="defaultStack"/>
<result name="error" type="velocity">/logout.vm</result>
<result name="success" type="redirect">/login.action?logout=true</result>
</action> |
to this:
| Code Block | ||
|---|---|---|
| ||
<action name="logout" class="com.atlassian.confluence.user.actions.LogoutAction">
<interceptor-ref name="defaultStack"/>
<result name="error" type="velocity">/logout.vm</result>
<result name="success" type="redirect">/mellon/logout?ReturnTo=%2Fdashboard.action</result>
</action> |
Now "jar" everything up again and replace the original jar:
| Code Block | ||
|---|---|---|
| ||
cd /tmp/jar jar cf /opt/confluence/confluence/WEB-INF/lib/confluence-5.5.3.jar . |
Restart Confluence. You should now also be able to use federated logins on your iPad/etc.
jsessionid errors
If unauthenticated users try to access content that is protected, Confluence tries to set jsessionid as part of the URL. This leads to 404 errors like this:
| Code Block |
|---|
NOT FOUND The requested URL /mellon/login;jsessionid=8A736F43779F96249F6C3DC41067BB98 was not found on this server. |
Since the jsessionid part isn't needed, it can be removed uses a rewrite statement (see apache config above).
Limit access to the unprotected TCP port
Confluence by default listens to TCP port 8090 on all interface. Since Apache will be the internet facing application, there is no need for Confluence to listen on all interfaces. Even worse, if you do let it listen on the internet then it is trivial to add a REMOTE_USER header and spoof any account. Of course it is good practice to use a firewall to protect this port, but you can limit this in Confluence as well. Since Apache is configured to only connect to the (IPv6) localhost address, this is what you should configure Confluence to use as listening address. As per Tomcat docs, you should add an "address" attribute to the Connector, which is located in conf/server.xml:
<Connector className="org.apache.coyote.tomcat4.CoyoteConnector" port="8090" address="::1" minProcessors="5"