Can a user with a disabled account browse anonymously

[Andrew Cooper]

I'm running Confluence 3.5.13.

I've got SSO authentication against our Active Directory forest working using the NTLMv2 plugin from TechTime.

Users with an active account in Confluence are logged in automatically, and users with no account can browse spaces as anonymous. No problem here.

There is an issue, though, with users who have an account in the Confluence database which has been disabled. Whatever they try to access they get a page which says, "You are not permitted to perform this action".

My question is this: Is it possible to configure Confluence so that a person with a disabled account is able to browse as an anonymous user can?

Deleteing the user's account is not feasible due to references from content they have contributed in the past. They can log out, but as soon as they go to another page the SSO authenticates them again and they're denied access.

I think I need a way to give users with disabled accounts the "Use Confluence" global permission while maintaining their disabled status for other purposes.

[Ed Letifov _TechTime - New Zealand_ · Accepted solution]

Well, my first attempt at the answer would be... ask TechTime? Oh, wait, that's us :) Thanks for linking!

So, let's try this again...

1) It is possible to force IOPlex Jespa (the library that actually does NTLM authenticaton under the bonnet) to install an anonymous identitiy into the session on logout. This will prevent users from getting logged in again immediately after explicit logout, but it will also remove the possibility of logging back in again by just clicking on anything outside of logout page. If you do want to go this route, just add/change this in Jespa filter definition in web.xml:

<init-param>
<param-name>http.parameter.anonymous.name</param-name>
<param-value>logout</param-value>
</init-param>
<init-param>
<param-name>http.parameter.logout.name</param-name>
<param-value>logout</param-value>
</init-param>
<init-param>
<param-name>fallback.location</param-name>
<param-value>/login.action?logout=true</param-value>
</init-param>

This tells Jespa 3 things:

• if you see logout parameter in the URL, do logout.
• If you see logout parameter in the URL install anonymous identity
• if for some reason authentication fails - go to login form and install anonymous identity while you are at it

2) This specific use case is valid IMHO, disabled users should NOT be logged in into Jira/Confluence even if they pass NTLM authentication. I will add logic to handle this into our plugin. Watch this space!

[Joe Clark]

Great tip, Ed! I've been doing Jespa installs in Confluence in my dev environments for a while now, and I never knew about this.

[Andrew Cooper]

Thanks Ed. That's a big help. I've added to this by putting some code in notpermitted.vm to redirect to the logout.action, and then in login.vm to redirect to the homepage on logout.

It's a big kludge but I think it will do until we get the updated plugin you metioned.

[Andy Brook [Plugin People]]

Yup, they will be reauthenticated and denied in an SSO environment, as there is no concept of anonymous. The only way is to use a browser that doent do the SSO, eg firefox? Thats how I worked around such stuff in the past.

[Andrew Cooper]

Doesn't work anymore. Current Firefox version support NTLMv2.

[Jobin Kuruvilla [Adaptavist]]

Can't they logout from Confluence and browse Anonymously?

[Andrew Cooper]

No. They can log out okay, but as soon as they try to access any content the SSO authenticates them again and they're denied access.