...

apt-get --no-install-recommends install openjdk-7-jdk

Download the source http://www.atlassian.com/software/confluence/downloads/binary/atlassian-confluence-5.56.3.tar.gz and unpack it to /opt/confluence. All relative paths mentioned below are relative to this directory.

...

Make sure that anonymous users can look at the content. Go to https://wikiexample.terena.orgcom/admin/permissions/globalpermissions.action

At this point you need to do some preparation so that stuff will work properly later on through Apache:

1. Create a new admin account with the correct federated username. For instance, if you have decided on using eduPersonPrincipalName as the username, and the value of that attribute for your federated account is 'dvisser@surfnet.nl', create an account with that exactly that username.
2. Make sure this newly created account is a member of "confluence-administrators".
3. Configure the Server Base Url to be the (HTTPS) URL that Apache will listen to. This is done in Confluence Admin -> General Configuration -> Edit.
4. Configure the global permissions to allow anonymous use (https://fqdnexample.com/admin/permissions/globalpermissions.action).

...

ServerName example.com
 
ProxyRequests Off
<Proxy http://ip6-localhost:8090>
    Require All Granted
</Proxy>


ProxyPass /mellon/ !
ProxyPass / http://ip6-localhost:8090/
ProxyPassReverse / http://ip6-localhost:8090/


# Mobile theme does not honour new seraph values for login URL, so we have to redirect that
RewriteEngine on
RewriteCond     %{QUERY_STRING} ^originalUrl=(.*)$      [NC]
Rewriterule     ^/plugins/servlet/mobile/login          /mellon/login?ReturnTo=%1 [R,NE]

# RemoveAfter theupgrading jsessionidto from5.6 the URL,mobile tologin preventlinks 404 errors whenwere changed. 
# unauthenticatedNew visitors try to access a protected resource.
ReWriteRuleredirects needed:
RewriteCond     ^%{QUERY_STRING} ^os_destination=%2Fplugins%2Fservlet%2Fmobile%3F%23content%2Fview%2F(.*);jsessionid=[A-Za-z0-9]+(.*)$ $1$2$ [NC]
RewriteRule     ^/login.action  /mellon/login?ReturnTo=/pages/viewpage.action?pageId=%1 [R,NE]


<Location />
        MellonEnable "info"
        MellonSecureCookie On
        MellonSessionDump # Remove the jsessionid from the URL, to prevent 404 errors when
# unauthenticated visitors try to access a protected resource.
ReWriteRule     ^(.*);jsessionid=[A-Za-z0-9]+(.*)$ $1$2 [R,NE]


<Location />
        MellonEnable "info"
        MellonSecureCookie On
        MellonSessionDump Off
        MellonUser "eduPersonPrincipalName"
        MellonSamlResponseDump Off
        MellonEndpointPath "/mellon"
        MellonSPPrivateKeyFile /etc/apache2/mellon/sp.key
        MellonSPCertFile /etc/apache2/mellon/sp.crt
        MellonIdPMetadataFile /etc/apache2/mellon/idp.xml

        RequestHeader unset CONF_FULL_NAME
        RequestHeader set CONF_FULL_NAME "%{MELLON_displayName}e" env=MELLON_displayName

        RequestHeader unset CONF_EMAIL
        RequestHeader set CONF_EMAIL "%{MELLON_mail}e" env=MELLON_mail
</Location>

...

1. Download the right version of remoteUserAuth.jar (I used 2.5.0) from https://github.com/chauth/confluence_http_authenticator/tree/master/releases, and store it in confluence/WEB-INF/lib. Make sure you're actually downloading the JAR file and not the HTML page.
2. Download https://github.com/chauth/confluence_http_authenticator/blob/master/conf/remoteUserAuthenticator.properties and save it as confluence/WEB-INF/classes/remoteUserAuthenticator.properties. The defaults were almost OK, the only thing I needed to change was convert.to.utf8=true.

3. Edit confluence/WEB-INF/classes/seraph-config.xml and change these values: 

   Code Block
   language html/xml
   <init-param> <param-name>login.url</param-name> <param-value>/login.action?os_destination=${originalurl}</param-value> </init-param> <init-param> <param-name>link.login.url</param-name> <param-value>/login.action</param-value> </init-param>

   To these: 

   Code Block
   language html/xml
   <init-param> <param-name>login.url</param-name> <param-value>/mellon/login?ReturnTo=${originalurl}</param-value> </init-param> <init-param> <param-name>link.login.url</param-name> <param-value>/mellon/login?ReturnTo=%2Fdashboard.action<${originalurl}</param-value> </init-param>

   Also, change the authenticator from this:

   Code Block
   <authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/>

   to this:

   Code Block
   <authenticator class="shibauth.confluence.authentication.shibboleth.RemoteUserAuthenticator"/>

...

I couldn't find any way to do this in Confluence, so I ended up rewriting it in Apache. See the snippet in the Apache config above.

Logout button & Invitation link

• mkdir /tmp/jar
• cd /tmp/jar
• jar xf /unzip /opt/confluence/confluence/WEB-INF/lib/confluence-5.5.3.jar -d /tmp/jar



        <action name="logout" class="com.atlassian.confluence.user.actions.LogoutAction">
            <interceptor-ref name="defaultStack"/>
            <result name="error" type="velocity">/logout.vm</result>
            <result name="success" type="redirect">/login.action?logout=true</result>
        </action>

        <action name="logout" class="com.atlassian.confluence.user.actions.LogoutAction">
            <interceptor-ref name="defaultStack"/>
            <result name="error" type="velocity">/logout.vm</result>
            <result name="success" type="redirect">/mellon/logout?ReturnTo=%2Fdashboard.action</result>
        </action>

cd /tmp/jar
jar cf /opt/confluence/confluence/WEB-INF/lib/confluence-5.5.3.jar .

NOT FOUND
The requested URL /mellon/login;jsessionid=8A736F43779F96249F6C3DC41067BB98 was not found on this server.

<link linkId="invite-tab-link">/admin/users/inviteuser.action</link>

NOT FOUND
The requested URL /mellon/login;jsessionid=8A736F43779F96249F6C3DC41067BB98 was not found on this server.

#LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
# Sortable log format, with proper federated username. DV 2016-04-05
LogFormat "%v:%p %{%F %T}t.%{msec_frac}t %h %{MELLON_CONF_USER}e \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined

wiki.geant.org:443 2016-04-05 14:23:10.714 2001:610:148:dead:49be:5225:a8a0:4b1f federated-user-3 "GET /rest/mywork/latest/status/notification/count HTTP/1.1" 200 944 "https://wiki.geant.org/dashboard.action" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.110 Safari/537.36"