Jira and Confluence user authentication with FreeIPA

[Jacob Jenner Rasmussen]

I have just setup my Jira and Confluence instances to use my FreeIPA instance as their
user directory. I'm leaving this message on how I did it in the hope somebody else
find it useful.

Note: I did this with Confluence version 6.10.1 and Jira version 7.12.0

For confluence you should create the groups "confluence-administrators" and
"confluence-users", and for Jira you should create the groups
"jira-software-administrators" and "jira-software-users"

Please note that only users that are part of confluence-users or jira-software-users will
be recognized by Confluence and Jira respectively. If you wan't a different set of
users to appear in Confluence and Jira change the User Object Filter field appropriately.

Add a new LDAP user directory and configure as follows. This applied to both Confluence
and Jira:

Server Settings:
 - Namel: FreeIPA
 - Directory Type: OpenLDAP
 - Server: example.com
 - Port: 389
 - Use SLL: false # Believe that you gonna to add the FreeIPA CA to the jdk cert store in
order to enable this
 - Username: uid=admin,cn=users,cn=accounts,dc=example,dc=com    # change admin to a
service specfic account
 - Password: <insert password here>

LDAP Schema:
 - Base DN: dc=example,dc=com
 - Additional User DN: cn=users,cn=accounts
 - Additional Group DN: cn=groups,cn=accounts

LDAP Permissions: Read Only

Advanced Settings: <default settings>

User Schema Settings:
 - User Object Class: inetorgperson
 - User Object Filter:
   - for confluence:
(&(objectclass=inetorgperson)(memberOf=cn=confluence-users,cn=groups,cn=accounts,dc=example,dc=com))
   - for jira:
(&(objectclass=inetorgperson)(memberOf=cn=jira-software-users,cn=groups,cn=accounts,dc=example,dc=com))
 - User Name Attribute: uid
 - User Name RDN Attribute: uid
 - User First Name Attriute: givenName  # This is wrong, FreeIPA doesn't seem to have
anything fits this field
 - User Last Name Attribute: sn
 - User Display Name Attribute: displayName
 - User Email Attribute: mail
 - User Password Attribute: userPassword
 - User Password Encryption: SHA
 - User Unique ID Attribute: ipaUniqueID

Group Schema Settings:
 - Group Object Class: groupofnames
 - Group Object Filter: (objectclass=groupofnames)
Note: "groupofnames" should be all lowercase
 - Group Name Attribute: cn
 - Group Description Attribute: description

Membership Schema Settings:
 - Group Members Attribute: member
 - User Membership Attribute: memberOf
 - Use the User Membership Attribute: false   # I'm not sure what to set this to, but
this works


One thing I haven't looked into that might be relevant to set under Advanced Settings
is the Enabled Nested Groups setting.

[Jacob Block]

Thanks for sharing this. As a follow-up, is there currently a path for SSO
with Jira + Confluence + Crucible and FreeIPA? It seems like there is a
shortcoming of Atlassian products missing Kerberos support.

On Tue, Aug 28, 2018 at 4:14 PM Jacob Jenner Rasmussen via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  I have just setup my Jira and Confluence instances to use my FreeIPA
>  instance as their user directory. I'm leaving this message on how I did it
>  in the hope somebody else find it useful.
>
>  Note: I did this with Confluence version 6.10.1 and Jira version 7.12.0
>
>  For confluence you should create the groups "confluence-administrators"
>  and "confluence-users", and for Jira you should create the groups
>  "jira-software-administrators" and "jira-software-users"
>
>  Please note that only users that are part of confluence-users or
>  jira-software-users will be recognized by Confluence and Jira respectively.
>  If you wan't a different set of users to appear in Confluence and Jira
>  change the User Object Filter field appropriately.
>
>  Add a new LDAP user directory and configure as follows. This applied to
>  both Confluence and Jira:
>
>  Server Settings:
>   - Namel: FreeIPA
>   - Directory Type: OpenLDAP
>   - Server: example.com
>   - Port: 389
>   - Use SLL: false # Believe that you gonna to add the FreeIPA CA to the
>  jdk cert store in order to enable this
>   - Username: uid=admin,cn=users,cn=accounts,dc=example,dc=com    # change
>  admin to a service specfic account
>   - Password: <insert password here>
>
>  LDAP Schema:
>   - Base DN: dc=example,dc=com
>   - Additional User DN: cn=users,cn=accounts
>   - Additional Group DN: cn=groups,cn=accounts
>
>  LDAP Permissions: Read Only
>
>  Advanced Settings: <default settings>
>
>  User Schema Settings:
>   - User Object Class: inetorgperson
>   - User Object Filter:
>     - for confluence:
>
> (&(objectclass=inetorgperson)(memberOf=cn=confluence-users,cn=groups,cn=accounts,dc=example,dc=com))
>     - for jira:
>
> (&(objectclass=inetorgperson)(memberOf=cn=jira-software-users,cn=groups,cn=accounts,dc=example,dc=com))
>   - User Name Attribute: uid
>   - User Name RDN Attribute: uid
>   - User First Name Attriute: givenName  # This is wrong, FreeIPA doesn't
>  seem to have anything fits this field
>   - User Last Name Attribute: sn
>   - User Display Name Attribute: displayName
>   - User Email Attribute: mail
>   - User Password Attribute: userPassword
>   - User Password Encryption: SHA
>   - User Unique ID Attribute: ipaUniqueID
>
>  Group Schema Settings:
>   - Group Object Class: groupofnames
>   - Group Object Filter: (objectclass=groupofnames)
>  Note: "groupofnames" should be all lowercase
>   - Group Name Attribute: cn
>   - Group Description Attribute: description
>
>  Membership Schema Settings:
>   - Group Members Attribute: member
>   - User Membership Attribute: memberOf
>   - Use the User Membership Attribute: false   # I'm not sure what to set
>  this to, but this works
>
>
>  One thing I haven't looked into that might be relevant to set under
>  Advanced Settings is the Enabled Nested Groups setting.
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>

[Simo Sorce]

You can use something like KeyCloak or Ipsilon as an Idp to which you
auth via kerberos, and then use their SAML or OIDC tokens to auth to
Atlassian products.

The net effect is Single Sign On, it works without issues.

On Wed, 2018-08-29 at 10:22 -0500, Jacob Block via FreeIPA-users wrote:
>  Thanks for sharing this. As a follow-up, is there currently a path
>  for SSO with Jira + Confluence + Crucible and FreeIPA? It seems like
>  there is a shortcoming of Atlassian products missing Kerberos
>  support.
>  
>  On Tue, Aug 28, 2018 at 4:14 PM Jacob Jenner Rasmussen via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>  > I have just setup my Jira and Confluence instances to use my FreeIPA instance as
> their user directory. I'm leaving this message on how I did it in the hope somebody
> else find it useful.
>  > 
>  > Note: I did this with Confluence version 6.10.1 and Jira version 7.12.0
>  > 
>  > For confluence you should create the groups "confluence-administrators"
> and "confluence-users", and for Jira you should create the groups
> "jira-software-administrators" and "jira-software-users"
>  > 
>  > Please note that only users that are part of confluence-users or jira-software-users
> will be recognized by Confluence and Jira respectively. If you wan't a different set
> of users to appear in Confluence and Jira change the User Object Filter field
> appropriately.
>  > 
>  > Add a new LDAP user directory and configure as follows. This applied to both
> Confluence and Jira:
>  > 
>  > Server Settings:
>  >  - Namel: FreeIPA
>  >  - Directory Type: OpenLDAP
>  >  - Server: example.com
>  >  - Port: 389
>  >  - Use SLL: false # Believe that you gonna to add the FreeIPA CA to the jdk cert
> store in order to enable this
>  >  - Username: uid=admin,cn=users,cn=accounts,dc=example,dc=com    # change admin to a
> service specfic account
>  >  - Password: <insert password here>
>  > 
>  > LDAP Schema:
>  >  - Base DN: dc=example,dc=com
>  >  - Additional User DN: cn=users,cn=accounts
>  >  - Additional Group DN: cn=groups,cn=accounts
>  > 
>  > LDAP Permissions: Read Only
>  > 
>  > Advanced Settings: <default settings>
>  > 
>  > User Schema Settings:
>  >  - User Object Class: inetorgperson
>  >  - User Object Filter:
>  >    - for confluence:
> (&(objectclass=inetorgperson)(memberOf=cn=confluence-users,cn=groups,cn=accounts,dc=example,dc=com))
>  >    - for jira:
> (&(objectclass=inetorgperson)(memberOf=cn=jira-software-users,cn=groups,cn=accounts,dc=example,dc=com))
>  >  - User Name Attribute: uid
>  >  - User Name RDN Attribute: uid
>  >  - User First Name Attriute: givenName  # This is wrong, FreeIPA doesn't seem to
> have anything fits this field
>  >  - User Last Name Attribute: sn
>  >  - User Display Name Attribute: displayName
>  >  - User Email Attribute: mail
>  >  - User Password Attribute: userPassword
>  >  - User Password Encryption: SHA
>  >  - User Unique ID Attribute: ipaUniqueID
>  > 
>  > Group Schema Settings:
>  >  - Group Object Class: groupofnames
>  >  - Group Object Filter: (objectclass=groupofnames)
>  > Note: "groupofnames" should be all lowercase
>  >  - Group Name Attribute: cn
>  >  - Group Description Attribute: description
>  > 
>  > Membership Schema Settings:
>  >  - Group Members Attribute: member
>  >  - User Membership Attribute: memberOf
>  >  - Use the User Membership Attribute: false   # I'm not sure what to set this
> to, but this works
>  > 
>  > 
>  > One thing I haven't looked into that might be relevant to set under Advanced
> Settings is the Enabled Nested Groups setting.
>  > _______________________________________________
>  > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...