SAML Single Sign-OnSAML Single Sign-On

Confluence Data Center

SAML Single Sign On is is tested with Confluence Data Center in the following environment.

Confluence-Nodes

The two Confluence-Nodes confluencedc01 and confluencedc02 are VMs running Debian 8 (Jessie) with Oracle Java version 1.8.0_66-b17.

The Confluence-version is 5.9.4, installed from the tgz-bundle.

The shared home-directory is shared using NFS.

server.xml is modified for the use behind a reverse proxy:

  1. <Server port="8000" shutdown="SHUTDOWN" debug="0">
  2. <Service name="Tomcat-Standalone">
  3. <!-- proxyName, proxyPort and scheme must be configured -->
  4. <Connector port="8090" connectionTimeout="20000" redirectPort="8443"
  5. proxyName="confluencedc59.lab.inserve.local"
  6. proxyPort="443"
  7. scheme="https"
  9. maxThreads="200" minSpareThreads="10"
  10. enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
  11. protocol="org.apache.coyote.http11.Http11NioProtocol" />
  12. <Engine name="Standalone" defaultHost="localhost" debug="0">
  13. <Host name="localhost" debug="0" appBase="webapps" unpackWARs="true" autoDeploy="false">
  14. <Context path="" docBase="../confluence" debug="0" reloadable="false" useHttpOnly="true">
  15. <!-- Logger is deprecated in Tomcat 5.5. Logging configuration for Confluence is specified in confluence/WEB-INF/classes/log4j.properties -->
  16. <Manager pathname="" />
  17. </Context>
  18. </Host>
  19. </Engine>
  20. </Service>
  21. </Server>

Confluence is started and stopped using this systemd-configuration under /etc/systemd/system/confluence594.service:

  1. [Unit]
  2. Description=Confluence 5.9.4
  3. After=network.target
  5. [Service]
  6. Type=simple
  7. User=confluence
  8. PIDFile=/opt/atlassian-confluence-5.9.4/confluence/work/catalina.pid
  9. ExecStart=/opt/atlassian-confluence-5.9.4/bin/start-confluence.sh -fg
  10. ExecStop=/opt/atlassian-confluence-5.9.4/bin/stop-confluence.sh
  12. [Install]
  13. WantedBy=multi-user.target

Database

PostgreSQL 9.4.3 is used as database running on host postgres01, a VM running Debian 8 (Jessie)

Load Balancer/Reverse Proxy

Apache 2.4.10 is used as reverse proxy/load balancer. It also runs on host postgres01. HTTPS is terminated on the reverse proxy.

This is the virtual host configuration:

  1. <VirtualHost *:443>
  2. ProxyRequests off
  4. #
  5. # confluence59.lab.inserve.local is set up as CNAME to postgres01 in the DNS
  6. #
  7. ServerName confluencedc59.lab.inserve.local
  9. #
  10. # Set a routeID-header. This is important to get sticky sessions: All requests from a client must
  11. # be served by the same Confluence node.
  12. # Without this header, WebSudo is not wirking and the SAMLSSO-Plugin caused redirection-loops between the Confluence nodes.
  13. #
  14. Header add Set-Cookie "ROUTEID=.%{BALANCER_WORKER_ROUTE}e; path=/" env=BALANCER_ROUTE_CHANGED
  16. <Proxy balancer://confluencecluster>
  17. BalancerMember http://confluencedc01.lab.inserve.local:8090 route=confluencedc01
  18. BalancerMember http://confluencedc02.lab.inserve.local:8090 route=confluencedc02
  20. # Security "we aren't blocking anyone but this the place to make those changes
  21. Order Deny,Allow
  22. Deny from none
  23. Allow from all
  24. </Proxy>
  26. # Here's how to enable the load balancer's management UI if desired
  27. <Location /balancer-manager>
  28. SetHandler balancer-manager
  29. # You SHOULD CHANGE THIS to only allow trusted ips to use the manager
  30. Order deny,allow
  31. Allow from all
  32. </Location>
  34. # Don't reverse-proxy requests to the management UI
  35. ProxyPass /balancer-manager !
  36. # Reverse proxy all other requests to the Confluence cluster
  37. ProxyPass / balancer://confluencecluster/ stickysession=ROUTEID
  38. ProxyPassReverse / balancer://confluencecluster
  39. ProxyPreserveHost on
  41. SSLProxyEngine On
  43. SSLEngine on
  44. SSLCertificateFile /etc/ssl/localcerts/star.lab.inserve.local.pem
  45. SSLCertificateKeyFile /etc/ssl/localcerts/star.lab.inserve.local.key
  46. SSLCertificateChainFile /etc/ssl/localcerts/labca.pem
  47. ErrorLog ${APACHE_LOG_DIR}/error.log
  48. CustomLog ${APACHE_LOG_DIR}/access.log combined
  49. </VirtualHost>