Rate this page:
This document describes how the default security system in Confluence works, using the Seraph library for HTTP authentication.
Extending the security system by subclassing Seraph's authenticator and configuring the seraph-config.xml
file is outside the scope of this document. Single Sign-on Integration with the Atlassian stack explains one way to integrate Seraph with Atlassian products.
The easiest way to understand Confluence's authentication process is with the following diagrams.
Because the Authenticator.login(request, response, username, password, rememberMe)
method occurs three times, and is slightly complex, it has been broken into its own sub-flowchart.
The default Seraph authenticator supports four methods of authentication, as can be seen in the flowchart:
Each method is tried in the order above. A successful login at an earlier method continues without checking the later methods. Failure at one method means continuing with the later methods until all are exhausted. At this point, the user is considered an anonymous user, and treated according to the permissions of an anonymous user in Confluence.
Looking through the source code will show that Seraph supports role-based authentication, but this is only used in Confluence for the /admin/
URL restriction.
From Confluence 7.10 you can no longer use request parameters to log in. If you need quick login for automated tests however, you can add the following system property:
atlassian.allow.insecure.url.parameter.login=true
This will allow you to use os_username
and os_password
request parameters.
Rate this page: