Integrating Crowd with Atlassian Confluence

Atlassian's popular Confluence wiki can quickly be configured to use Crowd for user and group management.

Compatibility of Confluence and Crowd Versions

Please ensure that your Crowd and Confluence versions are compatible:

Confluence バージョンSupported Crowd Version注意
Lower than 2.6.2N/AConfluence does not support Crowd - please upgrade Confluence.
Between 2.6.2 and 2.7.41.2 以降Confluence 2.6.1 is not supported - the earliest supported version is 2.6.2
Between 2.8 and 3.4.8Between 1.3.2 and 2.2.7

In Confluence 2.8, the interface for atlassian-user changed. Crowd 1.3.2 is the earliest version to support this change.

Note: As per CWD-2542 - Getting issue details... STATUS , atlassian-user support was removed as per Crowd 2.3. Thus, Crowd 2.2.7 is the latest version that will run with Confluence 3.4.8.

Confluence 3.5 以降Crowd 2.1 or LaterIn Confluence 3.5 and above, the communication between Confluence and Crowd has been changed from SOAP to REST.

Prerequisites

1 つの Tomcat コンテナに複数のアトラシアン アプリケーションをデプロイしないでください。

複数のアトラシアンアプリケーションを単一の Tomcat コンテナーにデプロイすることはサポート対象外です。この構成はテストされておらず、いずれかのアプリケーションのアップグレードにより (ポイントリリースであっても)、この設定が壊れる恐れがあります。また、この設定には多くの既知の問題があります (詳細は、こちらの FAQ を参照してください)。

弊社では、多くの実用的な理由から、複数のアトラシアンアプリケーションを単一の Tomcat コンテナーにデプロイするサポートは行っておりません。第一に、アプリケーションをアップグレードするには Tomcat をシャットダウンする必要があります。第二に、1つのアプリケーションがクラッシュすると、その Tomcat コンテナーで実行中のその他のアプリケーションにアクセスできなくなります。

したがって、Crowd を実行する Tomcat コンテナ内に他のアプリケーションをデプロイすることは推奨されません。このような他のアプリケーションが大容量のメモリを必要としたり、Tomcat の lib サブディレクトリ内に追加のライブラリを必要とする場合は特に推奨されません。

  1. Crowd をダウンロードしてインストールします。手順については「Crowd インストール ガイド」をご参照ください。ここでは Crowdルート フォルダを CROWD とします。
  2. Download and install Confluence (version 2.6.2 or later). Refer to the Confluence installation guide for instructions. We will refer to the Confluence root folder as CONFLUENCE. For the purposes of this document, we will assume that you have used the Crowd distribution (not EAR-WAR) (i.e. the easier) installation method of Confluence. If you need to install Confluence as an EAR/WAR, simply explode the EAR/WAR and make the necessary changes as described below, then repackage the EAR/WAR.
  3. Run the Confluence Setup Wizard, as described in the Confluence documentation. During this setup process, you will define the Confluence administrator's username and password. It is easier to do this before you integrate Confluence with Crowd.
  4. After setting up Confluence, shut down Confluence before you begin the integration process described below.

Step 1. Configuring Crowd to Talk to Confluence

1.1 Prepare Crowd's Directories/Groups/Users for Confluence

The Confluence application will need to authenticate users against a directory configured in Crowd. You will need to set up a directory in Crowd for Confluence. For more information on how to do this, see Adding a Directory. We will assume that the directory is called Confluence Directory for the rest of this document. It is possible to assign more than one directory for an application, but for the purposes of this example, we will use Confluence Directory to house Confluence users.

Confluence also requires particular groups to exist in the directory in order to authenticate users. You will need to create two groups in the Confluence Directory:

  1. confluence-users
  2. confluence-administrators

See the documentation on Creating Groups for more information on how to define these groups.

You also need to ensure that the Confluence Directory contains at least one user who is a member of both groups. Choose one of the two options below:

  • If you have an existing Confluence deployment and would like to import existing users and groups into Crowd, use the Confluence Importer tool by navigating to Users > Import Users > Atlassian Importer. Select 'Confluence' as the Atlassian product, and the Confluence Directory as the directory into which Confluence users will be imported. For details please see Importing Users from Atlassian Confluence.

    If you are going to import users into Crowd, you need to do this now before you proceed any further


    または

  • If you don't wish to import your Confluence users, make sure you use Crowd to create at least one user in the Confluence Directory and assign them to both the confluence-users and the confluence-administrators group. The Crowd documentation has more information on creating groups, creating users and assigning users to groups.

1.2 Define the Confluence Application in Crowd

Crowd needs to be aware that the Confluence application will be making authentication requests to Crowd. We need to add the Confluence application to Crowd and map it to the Confluence Directory:

  1. Crowd Administration Console にログインし、[Applications] > [Add Application] に移動します。
  2. Complete the 'Add Application' wizard for the Confluence application. See the instructions.

    The Name and Password values you specify in the 'Add Application' wizard must match the application.name and application.password that you will set in the CONFLUENCE/confluence/WEB-INF/classes/crowd.properties file. (See Step 2 below.)

1.3 Specify which Users can Log In to Confluence

Once Crowd is aware of the Confluence application, Crowd needs to know which users can authenticate (log in) to Confluence via Crowd. As part of the 'Add Application' wizard, you will set up your directories and group authorizations for the application. If necessary, you can adjust these settings after completing the wizard. Below are some examples.

You can either allow entire directories to authenticate, or just particular groups within the directories. In our example, we will allow the confluence-users and confluence-administrators groups within the Confluence Directory to authenticate.

詳細については「アプリケーションにアクセスできるグループを指定する」をご参照ください。

1.4 Specify the Address from which Confluence can Log In to Crowd

As part of the 'Add Application' wizard, you will set up Confluence's IP address. This is the address which Confluence will use to authenticate to Crowd. If necessary you can add a hostname, in addition to the IP address, after completing the wizard. See Specifying an Application's Address or Hostname.

Step 2. Configuring Confluence to talk to Crowd

The instructions for step 2 below apply to Confluence 3.5 or newer. If you use Confluence 3.4 or older, please follow "Step 2" on Integrating Crowd with Atlassian Confluence 3.4 or earlier instead.

2.1 Add a Crowd Directory in Confluence

Confluence can use Crowd for user authentication simply by adding the 'Atlassian Crowd' user directory.

  1. Log in to Confluence Admin as 'confluence-administrator'.
  2. Click on the 'User Directories' label of the left bar under the 'Security' tab.
  3. Click 'Add Directory'. Then select 'Atlassian Crowd' from the dropdown list. Click 'Next'.
  4. Enter connection parameters and save. Now a new Crowd directory should appear on the user directory list.

For more information on configuring a Crowd remote directory in Confluence, check out the Confluence documentation on Connecting to Crowd or Jira for User Management.

2.2 Enable SSO integration with Crowd (Optional)

  1. If Confluence is running, shut it down first.
  2. Now, edit the file CONFLUENCE/confluence/WEB-INF/classes/seraph-config.xml
    Comment out the line:-

    <!-- <authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/> -->
    

    Uncomment the line:-

    <authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/>
    
  3. CROWD/client/conf/ から CONFLUENCE/confluence/WEB-INF/classescrowd.properties ファイルをコピーします。
  4. CONFLUENCE/confluence/WEB-INF/classes/crowd.properties を編集します。次のプロパティを変更します。

    キー

    application.name

    confluence
    The application.name and application.password must match the Name and Password that you specified when defining the application in Crowd (see Step 1 above).

    application.password

    The application.name and application.password must match the Name and Password that you specified when defining the application in Crowd (see Step 1 above).

    crowd.base.url

    http://localhost:8095/crowd/
    If your Crowd server's port is configured differently from the default (i.e. 8095), set it accordingly.

    session.validationinterval

    This is the number of minutes between validation requests, when Crowd validates whether the user is logged in to or out of the Crowd SSO server. Set to the required number of minutes between validation requests. The recommended default is 2 minutes. Setting this value to 1 or higher will increase the performance of Crowd's integration.

    Setting this value to 0 will cause the application to perform authentication checks on each request but can cause poor performance, especially with Crowd 2.1 - Crowd 2.3.2 using REST due to CWD-2646.

    You can read more about optional settings in the crowd.properties file.


It is possible to define multiple user directories in Confluence. However, if you enable Crowd SSO integration, you will only be able to authenticate as users from the Crowd server defined in the crowd.properties file.

To log in using a user from another directory, such as the Confluence Internal Directory, you will need to either:

  • in the Confluence admin console, go to User Directories and disable the Crowd Server directory, or
  • disable Crowd SSO by reverting back to the default Confluence authenticator.
Steps to disable Crowd SSO:
  1. Shut down Confluence if it is currently running
  2. Edit the file CONFLUENCE/confluence/WEB-INF/classes/seraph-config.xml
  3. Uncomment the default Confluence authenticator:

    <authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/>

    Comment out the Crowd SSO Authenticator:

    <!-- <authenticator class="com.atlassian.confluence.user.ConfluenceCrowdSSOAuthenticator"/> -->

    Confluence を再起動します。

Crowd の動作を確認する

  • Users belonging to the confluence-users group should now be able to log in to Confluence.
  • Try adding a user to the confluence-users group using Crowd — you should be able to log in to Confluence using this newly created user. That's centralized authentication in action!
  • If you have enabled SSO, you can try adding the Confluence Directory and confluence-administrators group to the crowd application (see Mapping a Directory to an Application and Specifying which Groups can access an Application). This will allow Confluence administrators to log in to the Crowd Administration Console. Try logging in to Crowd as a Confluence administrator, and then point your browser at Confluence. You should be logged in as the same user in Confluence. That's single sign-on in action!
最終更新日: 2021 年 10 月 15 日

この内容はお役に立ちましたか?

はい
いいえ
この記事についてのフィードバックを送信する
Powered by Confluence and Scroll Viewport.