Jira 5.2 Seraph SSO Login behind reverse proxy

Question

Since a few days I'm trying to enable SSO for Jira 5.2 and figured out, that the help page from Jira is outdated.

Each example uses an old version of atlassian-seraph (Jira 5.2 uses 2.6.0).

Goal: I want to get automatically logged in into Jira if I'm logged in into Webseal (reverse proxy).

Background:

sequence diagram

Jira is behind a reverse proxy (see picture).
This proxy authentificatates the user and holds the session.
If I'm logged in I want to be logged in in Jira, too
The only information provided is the user name

Question:

How to write a custom login module that reads the username from http_header and authentificates the user?

Links:

score 11 · Accepted Answer · answered May 22 '13 at 07:23

In the end i figured it out by myself:

You need a custom authenticator

public class MyCustomAuthenticator extends DefaultAuthenticator {

  protected boolean authenticate(Principal user, String password)
    throws AuthenticatorException {
    return true;
  }

  protected Principal getUser(String username) {
   return getCrowdService().getUser(username);
  }

  private CrowdService getCrowdService() {
    return (CrowdService)ComponentManager.getComponent(CrowdService.class);
  }
}

Add the MyCustomAuthenticator to seraph-config.xml

<authenticator class="com.company.jira.MyCustomAuthenticator"/>

Write a Custom Filter to set the user name from http-header

public class CustomFilter extends PasswordBasedLoginFilter {

    @Override
    protected UserPasswordPair extractUserPasswordPair(
        HttpServletRequest request) {
        String username = request.getHeader("iv-header");

        if (username != null && username.trim().length() != 0) {
            return new PasswordBasedLoginFilter.UserPasswordPair(
                username, "DUMMY", false);
        }
        return null;
    }
}

Replace the filter within the web.xml

<filter>
   <filter-name>login</filter-name>
   <filter-class>com.company.jira.CustomFilter</filter-class>
 </filter>

These jar's are needed for Jira 5.2

embedded-crowd-api-2.6.2
jira-core-5.2.1
atlassian-seraph-2.6.0

@Tobias: Your answer involving CustomFilter was very helpful ... I also am implementing a Jira Custom authenticator for use behind a SAML-SSO reverse proxy, and that was the piece I needed to extract the HTTP auth header. But - in your getUser() implementation, you make use of the Crowd API. I'm curious, are you using this generically, in order to automatically grab the user from the HTTP request, or are you using Crowd across the board for SSO? I am not using Crowd, but would love to be able to pull the user in that way if possible, as it is so convenient. — danzvash, Jul 18 '13 at 13:56
@danzvash: I just use the crowd service to validate the user (Principal). I don't use any additional Crowd service just the api that already exists, because creating your own Principal can be really tough. I'm curios if I understand your question ?! :) — Tobias Sarnow, Jul 19 '13 at 07:09

score 1 · Answer 2 · answered Apr 29 '13 at 10:07

I am not familiar with Jira authentication, but I do understand well the SiteMinder/ WebSeal authentication.

Both systems authenticate user and send the user name in an HTTP header. The name of HTTP header can be configured. Also, they can send additional user properties, like the user email in the additional HTTP headers. TO authenticate a user behind SiteMinder/ WebSeal it is just required to take the HTTP header and to create an application session using the user name from the header.

You definitely can solve it in Jira. You have 2 options:

To use already created SiteMinder authenticator: https://confluence.atlassian.com/display/DEV/SiteMinder+Custom+Seraph+Authenticator+for+Confluence The problem that I did not find how to configure the HTTP header name for the user name header. It assumes that the header name is uid You need to configure the header uid in WebSeal or try to obtain sources and make the header name configurable.
Implement your own authenticator according to your link: http://docs.atlassian.com/atlassian-seraph/latest/sso.html Obtain the user name using the code httpServletRequest.getHeader(userNameHeaderName);

Reading the user-name from HTTP header is not the problem, if done a SSO Plugin for JBoss before. Unfortunately the example from your Option 2 is outdated and I haven't found any actual documentation. But I'll definitely checkout option 1. — Tobias Sarnow, Apr 29 '13 at 14:06

Jira 5.2 Seraph SSO Login behind reverse proxy

2 Answers2