NTLM Authenticator for Confluence

Added by Elliot Braham, last edited by Brett Vasconcellos on Aug 21, 2008  (view change)
Name NTLM Authenticator
Version 1.5.1
Product Versions Confluence v2.3 to v2.8.0
Author(s) Daniel Pavel, Stefan Farthofer, Elliot Braham, Andy Brook
Homepage here, there is also a FAQ
Price Free
License BSD
Support Supported (by Atlassian) only with the Sharepoint Connector for Confluence
Source http://svn.atlassian.com/svn/public/contrib/confluence/libraries/ntlmauth/trunk
Download stable 1.5, latest version stable 1.5.1 , unstable 1.5.2-snapshot (depends on ldaputils-1.0.12-SNAPSHOT.jar)
IssueTracking http://developer.atlassian.com/jira/browse/NTLM

Description/Features

A NTLM authenticator for Confluence using the Confluence's LDAP User Management. It also creates authenticated users, all authenticated users are automatically registered with the confluence-users group. Based heavily on Daniel Pavel's NTLM Authentication for JIRA. It depends on another library, the LDAP Util library that provides LDAP access via configurations within osuser.xml or atlassian-user.xml

Install

In order to do this you need to have LDAP authentication setup and working (hint: forget NTLM until basic LDAP authentication is working!). See LDAP User Management for more details.

To install the Confluence ntlmauth package, you need to perform the following steps after enabling Confluence's LDAP User Management.

Standalone vs Deployed war

How you configure a plugin will differ between the Tomcat standalone and the deployed war. The standalone version requires you to make changes in confluence/WEB-INF/... whereas The deployed version (where you have the source and can build your own war's) has the convention to put changes into edit-webapp/WEB-INF... , the instructions below will just refer to WEB-INF, whichever is applicable to you.

Please back up your configuration files before modifying them.

Get the main ntlm JAR

Download the latest ntlmauth jar from above, add it to the WEB-INF/lib folder.

Get the dependent JAR's

This plugin has two dependencies that need to be added to the WEB-INF/lib folder:

Update the web.xml file

For stand-alone instances, just edit the file (you backed it up right?). For build war's, copy confluence/WEB-INF/web.xml to edit-webapp/WEB-INF/.  , edits there then override the default.

Now add the following at the end of the list of filters:

<filter>
     <filter-name>ntlm</filter-name>
     <filter-class>com.jnj.confluence.NTLMFilter</filter-class>
</filter>

Additionally you need to add a filter mapping for the NTLM filter just before the "login" filter mapping:

<filter-mapping>
     <filter-name>ntlm</filter-name>
     <url-pattern>/*</url-pattern>
</filter-mapping>

Update the seraph-config.xml file

Change the authenticator in your confluence/WEB-INF/classes/seraph-config.xml file by replacing the existing authenticator element with:

<authenticator class="com.jnj.confluence.NTLMAwareAuthenticator"/>

LDAP Utils configuration

Although you don't have to specify any LDAP configuration per-se, some choices are available, such as 'atlassian-user' (default) or 'osuser' configured; if you want to change anything you need to unpack the ldaputil jar and edit ldaputils.properties.

TODO:// need to update this to reflect current code
Unpack the ldaputil JAR and edit the ldaputil.properties file, At the very least you will need to specify the ldaputil.ldap.searchBase property, the ldapAttribute keys should reflect your LDAP schema, or atlassian-user.xml config. Repack the jar, overwrite the original

Key Default Description
ldaputil.providerType atlassian-user use atlassian user config
ldaputil.osuser.providerClass com.opensymphony.user.provider.ldap.LDAPCredentialsProvider the provider class containing the ldap configuration in osuser.xml
ldaputil.ldap.searchBase REQUIRED along the lines of 'DC=something, DC=other'
ldaputil.ldap.emailLdapAttribute mail Mail, this is AD specific, configure as appropriate
ldaputil.ldap.userIdLdapAttribute sAMAccountName User account ID, this is AD specific, configure as appropriate
ldaputil.ldap.firstNameAttribute givenName First Name, this is AD specific, configure as appropriate
ldaputil.ldap.lastNameAttribute sn Surname, this is AD specific, configure as appropriate
ldaputil.ldap.narrowingFilterExpression (objectclass=user) this can be used to restrict the ldap lookup
ldaputil.ldap.fullNameFormat 0 Lastname, Firstname
ldaputil.ldap.forceUserIDCase 2 reflect stored value
ldaputil.ldap.subtreeScope 2 subtree scope

Restarting

For tomcat you should just be able to restart Confluence. For built war's, you naturally have to rebuild and redeploy the war.

Version History

Version Details
1.3
  • Port from JIRA NTLM Plugin
1.4
  • Added support for LDAP repositories requiring authentication, via the osuer.xml file, also to automatically create authenticated users with their details from LDAP and auto-add to confluence-users.
1.5
  • Extended automatic LDAP configuration to also make use of atlassian-user.xml, removed LDAP code from the plugin - hosted in its own library (ldaputils)
?
  • Extended ldaputil support to take account of multiple (ie all) LDAP DC's defined within atlassian-user.xml or osuser.xml
  • Extend ntlmauth to loop around all configured LDAP servers hunting for the right one for which the clients challenge works

Open Issues

Atlassian Developer Network JIRA (5 issues)
T Key Summary Assignee Reporter Pr Status Res Created Updated Due
Bug NTLM-14 Multiple Domain Malfunction Andy Brook Sir Blue Notes Critical Open UNRESOLVED Aug 26, 2008 Aug 27, 2008
Bug NTLM-13 NTLM works when I login on the application server it self but fails if I log in from a remote machine. Andy Brook David Van Ronk Major Open UNRESOLVED Aug 13, 2008 Aug 24, 2008
Bug NTLM-10 New users are not added to 'confluence-users' group automatically if already exist in the external_entities table Andy Brook Melly ISMIK Major Open UNRESOLVED Jun 25, 2008 Aug 10, 2008
Bug NTLM-7 NTLM configuration Andy Brook david Major Open UNRESOLVED Apr 01, 2008 Aug 10, 2008
Improvement NTLM-2 make this plugin work the RPC/SOAP interface Andy Brook Jamie Echlin Major Open UNRESOLVED Sep 05, 2007 Aug 10, 2008

misc stuff

Possible problem (i.e. it doesn't (according to my experience/environment) work) with IE6. IE7 seems to work fine.

Logging

If you want to see whats going on under the hood, update the log4j.properties file in WEB-INF/classes with:

#
# LDAP UTILS
#
log4j.logger.com.dolby.confluence.net.ldap=DEBUG, confluencelog
log4j.additivity.com.dolby.confluence.net.ldap=false

log4j.logger.com.dolby.confluence.net.ldap.atlassianuser=DEBUG, confluencelog
log4j.additivity.com.dolby.confluence.net.ldap.atlassianuser=false

log4j.logger.com.dolby.confluence.net.ldap.osuser=DEBUG
log4j.additivity.com.dolby.confluence.net.osuser=false

#
# NTLMAUTH
#
log4j.logger.com.jnj.confluence=DEBUG, confluencelog
log4j.additivity.com.jnj.confluence=false
Enter labels to add to this page:
Please wait 
Looking for a label? Just start typing.

Comments (167)

 

  1. Mar 09, 2007

    senthilraja says:

    Hi, we&nbsp;have deployed conluence in a linux box.&nbsp; Will this plugin work ...

    Hi,

    we have deployed conluence in a linux box.  Will this plugin work for us?

     Note:

    The Linux box is currently not added to AD domains.

    1. May 16, 2007

      Elliot Braham says:

      Probably. Let me know how you go\!

      Probably. Let me know how you go!

  2. Apr 20, 2007

    Eric Bardoux says:

    Hi, I've strictly followed the instructions. Once i've finished, i've restarted ...

    Hi,

    I've strictly followed the instructions.
    Once i've finished, i've restarted Confluence. When i the go to Confluence HomePage, i still have the login page, and whatever the login i enter (hibernate or ldap one), i stay on the login page, with no error message, and no trace in the logfiles.

    Any idea?

    Thanks

    Eric

    1. Apr 20, 2007

      Eric Bardoux says:

      More strange : I try to roll back, seraph and web.xml. Restart confluence. And i...

      More strange :

      I try to roll back, seraph and web.xml. Restart confluence. And i can't login anymore too!

  3. May 14, 2007

    Martin Cleaver says:

    Should the following work in log4j.properties? It doesn't for me. I want to trac...

    Should the following work in log4j.properties? It doesn't for me. I want to trace parameters authentication request.

    ## Logging for the NTLM authenticator
    log4j.logger.com.jnj.confluence.NTLMAwareAuthenticator=DEBUG, confluencelog

    Also, it is not clear as to whether  I must be using IIS (I am) and what options in IIS should be selected (e.g. Integrated Windows Authentication)

    1. May 15, 2007

      Elliot Braham says:

      Hi Martin, &nbsp;I'm using this on Confluence 2.3.3 Standalone with LDAP User ma...

      Hi Martin,

       I'm using this on Confluence 2.3.3 Standalone with LDAP User managament without any issues. I've never tried it on IIS.

       Regards, Elliot

  4. May 16, 2007

    Andy Brook says:

    I have Confluence 2.5.1, running in jboss405 (my normal, proven server), running...

    I have Confluence 2.5.1, running in jboss405 (my normal, proven server), running on a 32bit Ubuntu 6.10 VM. Using the plugin in combination with

    Using the attached JAR I get a stack on the server. In not fully conversant with jcifs or NTLM but have dome some LDAP work. I'm under the impression this plugin only currently works if confluence is deployed on a Windows box and is not usable on any other platform.

    My Stack with the default ntlmauth jar

    1:18:39,703 WARN  SMBHelper Could not connect to localhost's Windows authentication source!
11:18:39,704 ERROR [action] Servlet.service() for servlet action threw exception
java.lang.NullPointerException
        at jcifs.smb.SmbTransport.matches(SmbTransport.java:150)
        at jcifs.smb.SmbTransport.getSmbTransport(SmbTransport.java:49)
        at jcifs.smb.SmbTransport.getSmbTransport(SmbTransport.java:38)
        at jcifs.smb.SmbSession.getChallenge(SmbSession.java:145)
        at com.jnj.confluence.SMBHelper.getDCChallenge(SMBHelper.java:136)
        at com.jnj.confluence.NTLMWebHelper.doNTLM(NTLMWebHelper.java:91)
        at com.jnj.confluence.NTLMFilter.doFilter(NTLMFilter.java:125)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
        at com.atlassian.confluence.util.ClusterHeaderFilter.doFilter(ClusterHeaderFilter.java:35)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
        at com.atlassian.johnson.filters.JohnsonFilter.doFilter(JohnsonFilter.java:96)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
        at org.springframework.orm.hibernate.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:172)
at
	com.atlassian.spring.filter.FlushingSpringSessionInViewFilter.doFilterInternal(FlushingSpringSessionInViewFilter.java:29)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
        at com.atlassian.util.profiling.filters.ProfilingFilter.doFilter(ProfilingFilter.java:122)
        at com.atlassian.core.filters.ProfilingAndErrorFilter.doFilter(ProfilingAndErrorFilter.java:27)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
        at com.atlassian.confluence.util.RequestCacheThreadLocalFilter.doFilter(RequestCacheThreadLocalFilter.java:25)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
        at com.atlassian.core.filters.gzip.GzipFilter.doFilter(GzipFilter.java:53)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
        at com.atlassian.core.filters.AbstractEncodingFilter.doFilter(AbstractEncodingFilter.java:37)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at
	org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)

    I took the source code and after failing miserably to figure out how to load a properties file in JBOSS, hardwired a hostname field pointing to our network AD server. Logging in with a XP/Firefox combo (ie YES the authentication bit worked) prompted me for a user/pass, subsequent launches re-require a login (isn't NTLM supposed to fix that?).

    Even more strange is using XP/IE6 to the same server, IE6 doesnt present me with a login box and shows me the confluence front page with the option to login. Also, when this same user, a non-existing user (in confluence) but existing in AD, tried to login, they were told they couldn't login (ie the confluence-user auto-add bit doesnt appear to work either).

    This plugin seems to be heading in the right direction but I cant get it to do something useful. If anyone has a positive experience Id like to hear it.

    Theres no issue tracking link on this item so this will have to do for now. It just does not work in my (pretty typical) environment

    Comments?

    1. May 16, 2007

      Elliot Braham says:

      Hi Andy, Firefox doesn't handle NTLM very well. Check out this page to get NTLM ...

      Hi Andy,

      Firefox doesn't handle NTLM very well. Check out this page to get NTLM to work on Firefox: http://www.testingreflections.com/node/view/1365

      With IE it should handle the login automatically. There is a small bug that if you go directly to the /dashboard.action it doesn't log you in but a refresh does. You can alway go to the / and it will log you in.

      If a user is not in confluence-users it will add them

      I think you've basically got it working, if you say that it logs you in after typing in the username/password on Firefox.

      Let me know how you go trying http://confluence-server/ (or whatever) in IE.

      Regards, Elliot

  5. Jan 22, 2008

    Andy Brook says:

    Hi Elliot, For starters, I now have fully functional NTLM authentication for co...

    Hi Elliot,

    For starters, I now have fully functional NTLM authentication for confluence for Windows and Linux/Firefox clients (thanks for the link) I did have to customize the code a little and there are few funnies I found along the way, which I'll list here for others. for anyone else playing with.

    For anyone wanting to do similar things, I had it compiling happily in eclipse (no maven2 build yet!), The dependencies seem to have got listed under screenshots above:

    Code changes required:

    In order to point the NTLMAwareAuthenticator to my local windows Active Driectory box I needed to rework the SMBHelper static block to provide a server-name, the existing code does some Interface enumerations I don't fully understand, which always returns localhost, which wont work for most people. My modified code is below, I would have used a properties file but I'm temporarily defeated by jboss class-loaders! ), the Enumeration stuff is basically bypassed if the server is set: 

    static
	{
		UniAddress foundInterf = null;
		String serverName = "server.name";

		Enumeration<NetworkInterface> networks = null;
		try
		{
			networks = NetworkInterface.getNetworkInterfaces();
		}
		catch (SocketException sex)
		{
			log.error("Cannot enumerate network interfaces", sex);
		}

		InetAddress matchIa = null;
		if (serverName != null)
		{
			try
			{
				matchIa = InetAddress.getByName(serverName);
			}
			catch (UnknownHostException e)
			{
				log.error("Unknown Host Exceptoin, NTLM authentication DC cannot be resolved: " + serverName + ", got: "
						+ e.getLocalizedMessage());
			}
		}
		else if (networks != null)
		{
			log.info("checking local interfaces");
			while (networks.hasMoreElements() && matchIa == null)
			{
				NetworkInterface n = (NetworkInterface) networks.nextElement();

				for (Enumeration<InetAddress> ei = n.getInetAddresses(); ei.hasMoreElements() && foundInterf == null;)
				{
					InetAddress ia = (InetAddress) ei.nextElement();
					if (!ia.isLinkLocalAddress() && !ia.isLoopbackAddress())
					{
						matchIa = ia;
						break;
					}
				}
			}
		}

		AUTHENTICATING_DC = new UniAddress(matchIa);
		log.info("Created authdc : " + AUTHENTICATING_DC.getHostName() + " / " + AUTHENTICATING_DC.getHostAddress());
		int port = findDCPort(AUTHENTICATING_DC);
		if (port > 0)
		{
			AUTHENTICATING_DC_PORT = port;
		}

		if (AUTHENTICATING_DC == null)
		{
			log.warn("Could not connect to Windows Authentication source!");
		}
		else
		{
			log.info("Authentication Controller available: " + AUTHENTICATING_DC + ":" + AUTHENTICATING_DC_PORT);
		}
	}

    Things to remember /bugs

    1. Firefox (any platform) requires a configuration setting to allow NTLM to provoke firefox into putting up a Basic Auth login box, this then needs to have the 'DOMAIN\user' and 'password' combo set for the domain against which we are authenticating. To restate, setting up firefox for NTLM, in short is done through 'about:config', filter on 'ntlm' and modify 'network.automatic-ntlm-auth.trusted-uris' to include the hostname of the server running confluence.

    2. When the NTLMAuthenticator is in place it was not possible to initialize a fresh confluence install, I got the following in the server log whether using a Linux/Firefox or XP/IE combo browser (interesting stuff towards the bottom): 

    14:19:43,354 INFO  \[NTLMAwareAuthenticator\] getUser()14:19:43,354 INFO \[NTLMAwareAuthenticator\] Not logged in yet, getting status
14:19:43,354 INFO  \[NTLMAwareAuthenticator\] Not logged in yet, NTLM status: SUCCESS
14:19:43,354 INFO  \[NTLMAwareAuthenticator\] Found NTLM authentication information
14:19:43,354 FATAL \[SpringContainerContext\] Spring Application context has not been set
14:19:43,356 ERROR \[\[action\]\] Servlet.service() for servlet action threw exception
java.lang.IllegalStateException: Spring Application context has not been set
at com.atlassian.spring.container.SpringContainerContext.getComponent(SpringContainerContext.java:75)
at com.atlassian.spring.container.ContainerManager.getComponent(ContainerManager.java:32)
at com.atlassian.confluence.user.ConfluenceAuthenticator.getUserAccessor(ConfluenceAuthenticator.java:62)
at com.atlassian.confluence.user.ConfluenceAuthenticator.getUser(ConfluenceAuthenticator.java:69)
at com.jnj.confluence.NTLMAwareAuthenticator.getUser(NTLMAwareAuthenticator.java:116)
at com.atlassian.seraph.auth.AbstractAuthenticator.getUser(AbstractAuthenticator.java:44)
at com.atlassian.seraph.filter.SecurityHttpRequestWrapper.getUserPrincipal(SecurityHttpRequestWrapper.java:43)
at com.atlassian.seraph.filter.SecurityHttpRequestWrapper.getRemoteUser(SecurityHttpRequestWrapper.java:25)
at com.atlassian.confluence.util.LoggingContextFilter.doFilter(LoggingContextFilter.java:31)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.confluence.util.UserThreadLocalFilter.doFilter(UserThreadLocalFilter.java:44)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.seraph.filter.SecurityFilter.doFilter(SecurityFilter.java:83)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.seraph.filter.LoginFilter.doFilter(LoginFilter.java:93)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.jnj.confluence.NTLMFilter.doFilter(NTLMFilter.java:177)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.confluence.util.ClusterHeaderFilter.doFilter(ClusterHeaderFilter.java:35)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.johnson.filters.JohnsonFilter.doFilter(JohnsonFilter.java:96)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.spring.filter.FlushingSpringSessionInViewFilter.doFilterInternal(FlushingSpringSessionInViewFilter.java:26)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.util.profiling.filters.ProfilingFilter.doFilter(ProfilingFilter.java:122)
at com.atlassian.core.filters.ProfilingAndErrorFilter.doFilter(ProfilingAndErrorFilter.java:27)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.confluence.util.RequestCacheThreadLocalFilter.doFilter(RequestCacheThreadLocalFilter.java:25)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.core.filters.gzip.GzipFilter.doFilter(GzipFilter.java:61)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at com.atlassian.core.filters.AbstractEncodingFilter.doFilter(AbstractEncodingFilter.java:37)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:175)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:432)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:74)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.jboss.web.tomcat.tc5.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:156)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
at java.lang.Thread.run(Thread.java:619)
14:19:48,555 FATAL \[SpringContainerContext\] Spring Application context has not been set
14:19:48,566 ERROR \[\[jsp\]\] Servlet.service() for servlet jsp threw exception
java.lang.IllegalStateException: Spring Application context has not been set
at com.atlassian.spring.container.SpringContainerContext.getComponent(SpringContainerContext.java:75)
at com.atlassian.spring.container.ContainerManager.getComponent(ContainerManager.java:32)
at com.atlassian.confluence.core.ConfluenceActionSupport.getLocaleManager(ConfluenceActionSupport.java:623)
at com.atlassian.confluence.core.ConfluenceActionSupport.getLocale(ConfluenceActionSupport.java:548)
at com.atlassian.confluence.core.ConfluenceActionSupport.getI18n(ConfluenceActionSupport.java:611)
at com.atlassian.confluence.admin.actions.ViewSystemInfoAction.getUptime(ViewSystemInfoAction.java:270)
at com.atlassian.confluence.admin.actions.ViewSystemInfoAction.getBuildStats(ViewSystemInfoAction.java:126)
at org.apache.jsp._500page_jsp._jspService(_500page_jsp.java:141)
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:97)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:334)
at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:314)
at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:264)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:672)
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:465)
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:398)
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:301)
at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:363)
at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:284)
at org.apache.catalina.core.StandardHostValve.throwable(StandardHostValve.java:228)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:134)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.jboss.web.tomcat.tc5.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:156)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
at java.lang.Thread.run(Thread.java:619)
14:19:48,567 ERROR \[\[localhost\]\] Exception Processing ErrorPage\[errorCode=500, location=/500page.jsp\]
org.apache.jasper.JasperException: Exception in JSP: /500page.jsp:71

68:             ViewSystemInfoAction vsi = new ViewSystemInfoAction(pageContext.getServletContext());
69:             Map sysinfo = vsi.getProps();
70:             Map jvmstats = vsi.getJVMstats();
71:             Map buildstats = vsi.getBuildStats();
72:
73:             // orion does not support the exception object.
74:             boolean isOrion = "Orion".equals(vsi.getAppServer());

Stacktrace:
at org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:506)
at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:389)
at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:314)
at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:264)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:672)
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:465)
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:398)
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:301)
at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:363)
at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:284)
at org.apache.catalina.core.StandardHostValve.throwable(StandardHostValve.java:228)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:134)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.jboss.web.tomcat.tc5.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:156)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
at java.lang.Thread.run(Thread.java:619)


  6. May 22, 2007

    Andy Brook says:

    Ive had requests for the actual source code, Ill post here for anyone wanting to...

    Ive had requests for the actual source code, Ill post here for anyone wanting to point to an LDAP (eg Active Directory) server on another server. It will need to be built, and SMBHelper must be updated to reflect your server. If somone can show me how to load a properties file with the servername in then great, I tried a few routes but got bored.

    See attached jar : [Updated Source Jar|^updatedSourceForRemoteLDAPserver.jar] that has been used on a linux server pointing to an AD authenticator successfully.  Great work by the author, Im surprised Atlassian isn't taking this in as part of their authenticator lilne up....

    1. May 22, 2007

      Eric Bardoux says:

      The good thing would be to use the ldap server that is already set up in the atl...

      The good thing would be to use the ldap server that is already set up in the atlassian-users.xml file.

      Anyway, thanks for your work, i will check if i can have it working in my environment.

  7. Jun 04, 2007

    Neil Middleton says:

    We are having issues with this&nbsp; and getting the error: ERROR \http999Proces...

    We are having issues with this  - and getting the error:

    ERROR [http-999-Processor22] [com.jnj.confluence.NTLMWebHelper] doNTLM logon failed: A duplicate name exists on the network.

    I've no idea if it's relevant or not, but our JIRA install is on http://jiraserver:999 and confluence is http://jiraserver:999/confluence \\

  8. Jun 19, 2007

    Andy Brook says:

    Re: Duplicate name. This is a little cryptic, but what Ive seen is that if you ...

    Re: Duplicate name.

    This is a little cryptic, but what Ive seen is that if you use a dns alias for your ldap server, eg to save hard coding one in your app you use 'myldapserver' and add a local hosts entry to point to the correct one, well, apparently, this fact causes a duplicate name exception to be thrown during the NTLM conversation.  My fix: use the hostname, even though my original LDAP configuration in atlassian-user.xml worked with this, the NTLM did not.

    Re:atlassian-user.xml 

    Um, yea, this code didn't do the 'auto create an authenticated user' thing, leveraged someones code for that and added it here.  I've done that, and am about 1/2 a day away from added the LDAP lookup code to parse the atlassian-user.xml file.

    We should try to put this stuff under source control somewhere, I can't remember if  Atlassian offers this or not...  I'll be sure to post when all is working, probably next few days, for anyone who's interested, and to keep my end of the OpenSource bargain.

  9. Jun 25, 2007

    Andy Brook says:

    NTLM Authenticator User creator groupjoiner OK here is the final update to the o...

    NTLM Authenticator + User creator + group-joiner

    OK here is the final update to the original code, based on this projects code it does the following:

    • NTLM verified and working in a Linux environment
    • NTLM configuration obtained from parsing osuser.xml (so you'll need to be configured as an LDAP authenticator for this to work)
    • Auto verification of users, ensuring membership of a hardwired group 'confluence-users'
    • Auto registration/creation in confluence of authenticated users, and adding of such users to 'confluence-users' confluence group

    Notable source changes:

    I didn't need the network interface detection code/ couldn't figure out the point of it so I've commented it out. Other changes relate to plumbing for LDAP derived configuration for SMB auth server and code stuff like bracketing, logging and documentation.

    Summary

    This provides a 0 effort process for new users - they just go there and get created. It solves all my current security headaches, especially for security configuration migration, where I really don't want to key in hundreds of users. A test server I used this on just lists users who don't exist (yet) by their ID rather than name. Once they have logged in, the cross reference can be made and all works as expected.

    Future stuff 

    Coming full circle I'm going to retro fit this stuff back to deliver the same for JIRA.

    Files

    As no configuration is required within the NTLM jar, I can provide a JAVA-5 compiled [Binary|^ntlm-autoreg.jar] as well as [Source|^src-ntlm-autoreg.jar].

    1. Jun 25, 2007

      Scott J. Geertgens says:

      This may be redundant, but just so you're aware... the JIRA NTLM plugin actually...

      This may be redundant, but just so you're aware... the JIRA NTLM plugin actually already does all the above (auto-creation of users, auto-adding to jira-users (or other specified groups), etc.). 

      1. Jun 26, 2007

        Andy Brook says:

        Yes I have that up and running, it&nbsp; works fine and does what's needed.&nbsp...

        Yes I have that up and running, it  works fine and does what's needed.  My thoughts were for a zero LDAP config solution based on the osuser.xml file rather than duplicating picky LDAP stuff.  The JIRA plugin is certainly more advanced  and handles mulitple DOMAINS, as well as allowing per domain user creation.  But thats jira and Im not that familiar with what code is JIRA specific and whats common for Confluence use.

        Given Ive done the tricky bit of parsing the osuser file, creating a modified Authenticator to make use of this would provide most SME size companies with no brainer solution for what must be a common need (given my experience!)  That would allow one jar to be dropped into either application and configured appropriately.

        I don't really need to write it and may do so If I have the time - I may leave that extension to others.

    2. Jun 25, 2007

      Elliot Braham says:

      Wow Andy\! Sounds like you've done a fantastic job. When I get a chance I'm goin...

      Wow Andy!

      Sounds like you've done a fantastic job. When I get a chance I'm going to test it out!

       Is the NTLM configuration parsed from osuser.xml or atlassian-user.xml?

      Regards, Elliot

      1. Jun 26, 2007

        Andy Brook says:

        Hi Elliot, It parses osuser.xml, which I think is 'current' correct me if I'm wr...

        Hi Elliot,

        It parses osuser.xml, which I think is 'current' - correct me if I'm wrong?  The code is structurally identical to the original but has been _bracketed_ (a personal hate of mine!).

        I'm migrating our users from a nightmare of AD mailing lists and mangled AD group names and trying to advocate the principle of maximum authority for confluence-users, internally.  This code means I have 0 manual overhead for the common case.

        A source code repository would be useful for this stuff - do atlassian support this?  Its not really worth sourceforging.

        andy 

        1. Jun 27, 2007

          Eric Bardoux says:

          Well hum, euh... for a standard configuration of Confluence, all the connection ...

          Well hum, euh... for a standard configuration of Confluence, all the connection information to the LDAP is in the atlassian-users.xml. See below for my own example.

          Great job anyway, i'm pretty sure you are close from the perfect NTLM authenticator

          <atlassian-user>
              <repositories>

                  <!- Default confluence user repository ->
                  <!--
                          <osuser key="osuserRepository" name="OSUser Repository"/>
          -->
                  <!- LDAP repository ->

                  <ldap key="ldapRepository" name="pasteur GC" cache="true">
                                  <host>url.pasteur.com</host>
                                  <port>3268</port>

                                  <securityPrincipal>CN=-----------,OU=System Accounts,OU=FR Lyon HQ,DC=pasteur,DC=aventis,DC=com</securityPrincipal>
                                  <securityCredential>---------</securityCredential>
                                  <securityAuthentication>simple</securityAuthentication>

                                  <securityProtocol>plain</securityProtocol>
                                  <baseContext>DC=aventis,DC=com</baseContext>

                                  <baseUserNamespace>DC=aventis,DC=com</baseUserNamespace>
                                  <baseGroupNamespace>DC=aventis,DC=com</baseGroupNamespace>
                                  <usernameAttribute>sAMAccountName</usernameAttribute>
                                  <userSearchFilter>(objectClass=person)</userSearchFilter>
                                  <firstnameAttribute>givenName</firstnameAttribute>
                                  <surnameAttribute>sn</surnameAttribute>
                                  <emailAttribute>mail</emailAttribute>

                                  <groupnameAttribute>cn</groupnameAttribute>
                                  <groupSearchFilter>(objectClass=group)</groupSearchFilter>
                                  <membershipAttribute>member</membershipAttribute>
                          </ldap>

                          <hibernate name="Hibernate Repository" key="hibernateRepository"  description="Hibernate Repository" />

              </repositories>
          </atlassian-user>