Access Confluence using Integrated Windows Authentication via IIS with SP 2007

Caveats

Supported Platforms

Due to the complex nature of this configuration, Atlassian is only able to provide support if your configuration satisfies these additional conditions:

• Confluence must be installed as a stand-alone Tomcat application server.
• IIS and Confluence must be hosted on the same logical server (unless Confluence is running on a non-Windows system).
• The only supported operating systems for this configuration are Windows Server 2003 and Windows Server 2008.
• The server must be a member of the same Active Directory domain that contains the user records that will be authenticated.
• Confluence must be configured to use LDAP integration to Active Directory for user management.

Additional Dependencies

Using this configuration adds a number of additional dependencies to Confluence, which you should review.

Custom Seraph Authenticator

This configuration requires the use of a specialised Seraph authenticator for Confluence. If you are already using a different custom Seraph authenticator, you may not be able to use this configuration. In this situation, you must either choose a different configuration for the SharePoint Connector or consider developing a new custom Seraph authenticator that aggregates the functionality of both.

Custom ISAPI Filter

This configuration requires the use of a custom ISAPI filter for IIS that can communicate using AJP. Atlassian will only support the use of the open source Tomcat Connector provided by the Apache Tomcat project.

Anonymous Access Disabled

Due to limitations with the custom Seraph authenticator that Confluence requires for this configuration, it is not possible to set up anonymous access for Confluence when using this configuration.

Atlassian is currently reviewing the suitability of using the third-party NTLM Authenticator for Confluence instead.

Known issues

These are some reported problems with this configuration:

• The user is not able to explicitly log out. Even when they select the logout action, they remain logged-in.
• If you log in using NTLM authentication as a user that does not exist in the AD repository, you will not see the personal menu in Confluence's top navigation bar.
• You cannot fall back to using forms-based authentication or anonymous authentication.

Installation Instructions

Step 1. Configure Confluence for LDAP User Management

Set up your Confluence server to synchronise its user repository with your Windows Active Directory domain. See the Confluence documentation on LDAP user management.

Step 2. Configure IIS

This and following steps guide you through the configuration required to use IIS as an NTLM authenticator for Confluence. NTLM is an authentication format developed by Microsoft. While some third-party implementations are available, IIS provides the most robust and full-featured NTLM authentication support.

Summary of this configuration:

• It places the Tomcat application server running Confluence behind an IIS website configured for Integrated Windows Authentication.
• IIS is then configured with a custom ISAPI handler that communicates directly with the Tomcat server using Apache JServ Protocol to serve the Confluence content back to the user.

Please follow the guide below that matches the version of your Windows Server:

• Windows Server 2003: Configuring Tomcat-Connector for IIS 6.0 (Windows Server 2003)
• Windows Server 2008: Configuring Tomcat-Connector for IIS 7.0 (Windows Server 2008)

Step 3. Configure Confluence for Integrated Windows Authentication

This section of the guide describes the steps necessary to configure Confluence to co-operate with the IIS Web Server.

Throughout this section, '%confluence_install%' refers to your Confluence installation directory .

Step 3.1: Set Confluence Path

1. Edit the %confluence_install%\conf\server.xml file.
2. Find the Context element in the file, and then change the path value to '/confluence'.
   The line should look something like this:

   <Context path="/confluence" docBase="../confluence" debug="0" reloadable="false">

3. Save your changes and close the file.
4. Restart Confluence and verify that it is now accessible from the new path, such as http://localhost:8080/confluence.

Step 3.2: Add AJP Connector

Now you will change Tomcat's configuration, replacing the standard Coyote HTTP connector (which allows Tomcat to send and receive HTTP traffic) with a custom AJP connector (which allows Tomcat to communicate using Apache JServ Protocol).

1. Edit the %confluence_install%\conf\server.xml file.
2. Locate the Connector element and comment it out entirely.
3. Add a new Connector element that looks like the one below. The values that must match exactly are address, protocol and tomcatAuthentication:

   <Connector port="8009" address="127.0.0.1" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" tomcatAuthentication="false" URIEncoding="UTF-8" />

   If IIS is not located on the same server as Confluence, then you should not enter the address value at all.

4. Ensure that your server.xml file now contains only a single Connector definition.
5. Save your changes and close the file.
6. Restart Confluence and ensure that the server initialises successfully.

Step 3.3: Add Custom Authenticator

By default, Confluence will not understand the pre-authenticated requests that come through via the IIS Web Site. In order to allow this authentication information to pass through, you must modify the authenticator module used by Confluence.

1. Download the customauth-0.4.jar file attached to this page and place it in your %confluence_install%\confluence\WEB-INF\lib directory.
2. Edit the %confluence_install%\WEB-INF\classes\seraph-config.xml file.
3. Locate the authenticator element and comment it out entirely.
4. Add a new authenticator element that looks like this:

   <authenticator class="com.pixelpark.seraph.SSOAuthenticator" />

5. Save your changes and close the file.
6. Restart Confluence and ensure that the server initialises successfully.

Step 3.4: Modify Base URL

The final step in configuring Confluence is to modify the Server Base URL to point to the IIS web site, rather than directly to Confluence. This ensures that any hyperlinks generated within Confluence pages will direct users through the IIS website. For example, if your Tomcat server runs Confluence on http://intranet.company.com:8080/confluence and the IIS web site runs on http://intranet.company.com, then the Confluence Base URL needs to be changed to http://intranet.company.com/confluence.

See the Confluence documentation for instructions on modifying the Base URL.

Step 4. Set Client Browser Options

In order for users to be automatically logged in to Confluence without being prompted for their username and password, the browser must be correctly configured for pass-through authentication.

Please instruct all users to ensure that the recommended browser settings are applied.