...
Below is the recipe for getting this to work with Ubuntu 12.04, Confluence 5.1.1.1, Apache, and modmellon.
I choose modmellon because it seemed like a cleaner solution than mod_shib, requiring no additional daemons and much simpler configuration.
...
Download the source http://www.atlassian.com/software/confluence/downloads/binary/atlassian-confluence-5.1.1.tar.gz and unpack it to /opt/confluence. All relative paths mentioned below are relative to this directory.
...
mkdir /tmp/jarcd /tmp/jarjar xf /opt/confluence/confluence/WEB-INF/lib/confluence-5.1.1.jar
xwork.xml and change this part:
| Code Block | ||
|---|---|---|
| ||
<action name="logout" class="com.atlassian.confluence.user.actions.LogoutAction">
<interceptor-ref name="defaultStack"/>
<result name="error" type="velocity">/logout.vm</result>
<result name="success" type="redirect">/login.action?logout=true</result>
</action> |
to this:
| Code Block | ||
|---|---|---|
| ||
<action name="logout" class="com.atlassian.confluence.user.actions.LogoutAction">
<interceptor-ref name="defaultStack"/>
<result name="error" type="velocity">/logout.vm</result>
<result name="success" type="redirect">/mellon/logout?ReturnTo=%2Fdashboard.action</result>
</action> |
Now "jar" everything up again and replace the original jar:
| Code Block | ||
|---|---|---|
| ||
cd /tmp/jar
jar cf /opt/confluence/confluence/WEB-INF/lib/confluence-5.1.1.jar . |
Restart Confluence. You should now also be able to use federated logins on your iPad/etc.
Post install
Limit access to the unprotected TCP port
Confluence by default listens to TCP port 8090 on all interface. Since Apache will be the internet facing application, there is no need for Confluence to listen on all interfaces. Even worse, if you do let it listen on the internet then it is trivial to add a REMOTE_USER header and spoof any account. Of course it is good practice to use a firewall to protect this port, but you can limit this in Confluence as well. Since Apache is configured to only connect to the (IPv6) localhost address, this is what you should configure Confluence to use as listening address. As per Tomcat docs, you should add an "address" attribute to the Connector, which is located in conf/server.xml:
<Connector className="org.apache.coyote.tomcat4.CoyoteConnector" port="8090" address="::1" minProcessors="5"