Open breagan1983 opened 7 years ago
IMHO there seems to be a problem only with the redirect URL. We have also had various problems with it. We are using a short PHP script to ensuri it is correct:
$target = $_GET['url']; $expire = time()+60608; setcookie("crowd_shib_user","YES",$expire); $test = stristr($target, "//"); if ($test=="") $target="https://wiki.helsinki.fi".$target; $target = str_ireplace("http:","https:",$target); $target = str_ireplace("dashboard.action","",$target); $target = urlencode($target); $target = urlencode($target); header("LOCATION:"."https://crowd.it.helsinki.fi/Shibboleth.sso/HYLogin?target=https://crowd.it.helsinki.fi/crowd/plugins/servlet/ssocookie?redirectTo=$target");
(The cookie is set to show the user has authenticated with Shibboleth, local accounts are also posssible)
Hi @erkkiaalto - thanks for the feedback! Couple follow up questions:
For example, mine on Confluence was <a href="https://crowd.domain/crowd/plugins/servlet/ssocookie?redirectTo=targetURL">Login with Shibboleth</a>
Is yours something to the effect of: <a href="https://wiki.helsinki.fi/login.php?url=dashboard.action">Login</a>
?
Is there documentation anywhere on what parameters the ssocookie servlet is expecting? It's strange to me that at times it seems to be successfully processing the requests, e.g. when it initially returns a 302, but then later throws a 404.
Is there anywhere ssocookie logs error messages? I was checking the atlassian-crowd.log and catalina.out (which I think have the same content anyways), and not seeing anything there.
Again, thanks for your help with this; much appreciated.
We have in our login.vm
\\\
No knowledge about documentation. I think there was a way to get debug info from the ssocookie, but I do not remember anymore, how. Anyway, you had a valid session, didn't you? Then it seems the autheticator is OK and you need onlky to get the redirects right.
The 404 seems really suspect as the servlet code itself does not generate a http 404. It might be a case of your redirect parameter being wrong if it is just dashboard.action. If you have Confluence and Crowd running on the same host or behind the same proxy then it might work but only with the proper context path. To be on the safe side you should include the original url in its entirety. As an example if your Confluence instance is located at https://your.domain.com/confluence the correct login url would be https://your.domain.com/crowd/plugins/servlet/ssocookie?redirectTo=https%3A%2F%2Fyour.domain.com%2Fdashboard.action
While the documentation in places might state that the plugin is not compatible 2.7 or 2.8 this is not correct. We have encountered it running on 2.9, 2.10 and 2.11. It's just a consequence of the age old problem of documentation rarely getting updated unless there is a dedicated person to update it.
Hi all-
Thanks for the feedback. Unfortunately the issue still persists, despite any and all tweaking of the redirectTo link. Right now, this is the link I'm using:
It's strange, eh? I'm getting a valid session, just the redirect not working. All services running on the same VM. NGINX is handling the SSL offloading, and the shibauth and shibresponder sockets. Just can't seem to find an error or warning in any of the logs.
Anybody have any luck enabling verbose logging for redirect issues?
If you set DEBUG level for the net.nordu.crowd.sso package the servlet should output "Redirecting to {your url here}". With your given url it should not be redirecting back to the same servlet though
Hi-
Attempting to make Crowd v2.12.0 (Build:#751) and this plugin work with the current versions of Confluence, JIRA, and BitBucket.
I seem to have this plugin working to the extent that I can:
The requested resource is not available
Here's the interesting thing.... I can then go to the confluence URL and I have an active session.
Couple of the causes I can certainly imagine are:
There's no WARNs or ERRORs listed in atlassian-crowd.log. I'm not also seeing anything in the shib logs.
I'll continue to research this and see if I can make it work. Seems like if I can resolve this issue, I'll have a sucessfull instance of Crowd 2.12.0 & Shibd/NGINX working with latest revisions of the other Atlassian products. Hoping to get this online, and contribute my notes of getting it online for others. Thanks to all for any help you might provide.