Will the companion app support SAML?

[Stephan Krinetzki]

Hello,

we are using Confluence behind a BIG IP F5 loadbalancer and with Shibboleth as SSO provider. This setup works great, but now we have a problem with the companion app. The connection between the browser and the companion app works - even the correct app is started. But instead of the file we are getting the error message of our Identity Provider. So we need an option, to reauthenticate the companion app with our Identity Provider.

[Shannon S]

Hi Stephan,

Can you let me know exactly what the error message is that you're receiving?

I believe this could be related to this bug:

• CONFSERVER-57486

As for a workaround, there's a mention on this thread regarding how to revert to the old editor:

• CONFSERVER-56317

You can start reading from Sarathi's comment there on how they worked around it.

Being frustrated with this introduction of dependency on the companion app , I have copied the office connector from 6.10 to 6.12

So replaced the  OfficeConnector-7.0.3.jar in 6.12 with OfficeConnector-6.0.0.jar  in 6.10

Simply copy the file OfficeConnector-6.0.0.jar to {Install Location}/confluence/WEB-INF/atlassian-bundled-plugins-setup/  and rename the existing OfficeConnector-7.0.3.jar to something non .jar  and restart the service.

This seems to work perfectly fine so far.

Not sure if this an acceptable workaround for now - but if any one on this forum tries this out then please let me know if there are any issues.

I cannot attach the jar here but if you have an older version of confluence installed in your other environments you should be able to copy it over from there. 

I hope this helps!

Regards,

Shannon

[Stephan Krinetzki]

Hello, Shannon,
the problem is not the plugin itself, but our authentication. To use the Confluence Wiki, the user has to authenticate to Apache via Shibboleth. Only then the user can use the wiki at all. The Companion app now opens another session outside the browser, retrieves a link that is also protected with Shibboleth. Instead of asking for authentication, the app downloads the error page from Shibboleth and saves it as docx/xlsx etc and the document is broken. So it is a problem of a missing Apache authentication.

[Stephan Krinetzki]

From the Log:

[
{"namespace":"adc:manifest-controller","date":"2018-11-16T09:49:24.449Z","message":["enabling manifest:","file"]},
{"namespace":"adc:manifest-controller","date":"2018-11-16T09:49:24.449Z","message":["disabling manifest:","screen"]},
{"namespace":"adc:manifest-controller","date":"2018-11-16T09:49:24.449Z","message":["enabling manifest:","feedback"]},
{"namespace":"adc:manifest-controller","date":"2018-11-16T09:49:24.449Z","message":["enabling manifest:","license"]},
{"namespace":"adc:manifest-controller","date":"2018-11-16T09:49:24.449Z","message":["enabling manifest:","feedback"]},
{"namespace":"squirrel.windows","date":"2018-11-16T09:49:24.511Z","message":["processing argv as squirrel command '--was-opened-at-login'"]},
{"namespace":"adc:browser","date":"2018-11-16T09:49:24.511Z","message":["detected the app was launched at login, delaying start up by 30 seconds"]},
{"namespace":"adc:auto-updater","date":"2018-11-16T09:49:24.511Z","message":["using update URL for channel:","stable"]},
{"namespace":"adc:auto-updater","date":"2018-11-16T09:49:24.511Z","message":["constructed URL:","https://update-nucleus.atlassian.com/Atlassian-Companion/291cb34fe2296e5fb82b83a04704c9b4/win32/ia32"]},
{"namespace":"adc:auto-updater","date":"2018-11-16T09:49:24.527Z","message":["checking for update"]},
{"namespace":"adc:auto-updater","date":"2018-11-16T09:49:24.683Z","message":["autoUpdate initialized successfully"]},
{"namespace":"adc:file-manager","date":"2018-11-16T09:49:25.105Z","message":["clearing file manager cache"]},
{"namespace":"adc:settings","date":"2018-11-16T09:49:25.167Z","message":["opening settings store"]},
{"namespace":"adc:analytics","date":"2018-11-16T09:49:25.444Z","message":["event","companion.start",{"new":false},"7714c9bc-1136-459f-a60e-c10318133725"]},
{"namespace":"adc:core","date":"2018-11-16T09:49:25.687Z","message":["generating tray menu from manifests"]},
{"namespace":"adc:websocket:auth","date":"2018-11-16T09:49:33.478Z","message":["error occurred while checking true time",{}]},
{"namespace":"adc:browser","date":"2018-11-16T09:49:55.122Z","message":["launching websocket"]},
{"namespace":"adc:proxy-bypass","date":"2018-11-16T09:49:55.325Z","message":["Checking local proxy"]},
{"namespace":"adc:proxy-bypass","date":"2018-11-16T09:49:55.325Z","message":["Checking local proxy"]},
{"namespace":"adc:browser","date":"2018-11-16T09:49:55.325Z","message":["direct websocket launched successfully on port:",31459]},
{"namespace":"adc:browser","date":"2018-11-16T09:49:55.341Z","message":["ssl websocket launched successfully on port:",22274]},
{"namespace":"adc:auto-updater","date":"2018-11-16T09:54:25.970Z","message":["checking for update"]},
{"namespace":"adc:auto-updater","date":"2018-11-16T09:59:25.487Z","message":["checking for update"]},
{"namespace":"adc:auto-updater","date":"2018-11-16T10:04:25.883Z","message":["checking for update"]},
{"namespace":"adc:websocket","date":"2018-11-16T10:04:34.180Z","message":["new client connection"]},
{"namespace":"adc:websocket","date":"2018-11-16T10:04:34.180Z","message":["received message:","{\"type\":\"authentication\",\"payload\":{\"provider\":\"server\",\"payload\":{\"siteTitle\":\"Confluence\"}},\"requestID\":1}"]},
{"namespace":"adc:serverauth","date":"2018-11-16T10:04:34.180Z","message":["Found trusted domain in database:","wiki-intern.itc.rwth-aachen.de"]},
{"namespace":"adc:websocket","date":"2018-11-16T10:04:34.195Z","message":["received message:","{\"type\":\"new-transaction\",\"payload\":{\"transactionType\":\"file\"},\"requestID\":2}"]},
{"namespace":"adc:websocket","date":"2018-11-16T10:04:34.195Z","message":["received message:","{\"transactionID\":\"bc7f1b6c-fbe2-465a-aaba-7f149fb924e6\",\"type\":\"list-apps\",\"payload\":{\"extension\":\"txt\"},\"requestID\":3}"]},
{"namespace":"adc:websocket","date":"2018-11-16T10:04:34.195Z","message":["received transaction message for:","bc7f1b6c-fbe2-465a-aaba-7f149fb924e6"]},
{"namespace":"adc:transaction:bc7f1b6c-fbe2-465a-aaba-7f149fb924e6","date":"2018-11-16T10:04:34.211Z","message":["handling apps list request",{"extension":"txt"}]},
{"namespace":"adc:websocket","date":"2018-11-16T10:04:35.477Z","message":["received message:","{\"transactionID\":\"bc7f1b6c-fbe2-465a-aaba-7f149fb924e6\",\"type\":\"launch-file-in-app\",\"payload\":{\"fileURL\":\"https://wiki-intern.itc.rwth-aachen.de/download/attachments/75825874/test.txt?version=1&modificationDate=1540974292000&api=v2&download=true&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqd3Quc3ViamVjdC5jb25mbHVlbmNlLXByZXZpZXdzLnRlbXBsaW5rc3Jlc291cmNlIiwicXNoIjoiNzA3M2JmMmU1MThlYmRkY2IxZTU4M2I4ZGIwN2RlNWE4YTIzMzU1OTdhOTYyYjE4NjgxYjdiYjg3NTNkZWNhYSIsImlzcyI6ImNvbS5hdGxhc3NpYW4uY29uZmx1ZW5jZS5wbHVnaW5zLnByZXZpZXdzIiwiZXhwIjoxNTQyMzYyNzQxLCJpYXQiOjE1NDIzNjI2ODEsInVzZXJLZXkiOiJmZjgwODA4MTRjNzVlM2QzMDE0ZGY1ZjBmYTA0MDAyMCJ9.7nbb9CwVhNdf1UTmczwcgusYqD7niWB8KWAcGfpmiPU\",\"applicationID\":\"3394eeeccfa6f14ee686c41069e48876\",\"fileName\":\"test.txt\",\"submitChangesURL\":\"\",\"autoUpload\":false},\"requestID\":4}"]},
{"namespace":"adc:websocket","date":"2018-11-16T10:04:35.477Z","message":["received transaction message for:","bc7f1b6c-fbe2-465a-aaba-7f149fb924e6"]},
{"namespace":"adc:transaction:bc7f1b6c-fbe2-465a-aaba-7f149fb924e6","date":"2018-11-16T10:04:35.477Z","message":["handling file launch request",{"fileURL":"https://wiki-intern.itc.rwth-aachen.de/download/attachments/75825874/test.txt?version=1&modificationDate=1540974292000&api=v2&download=true&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqd3Quc3ViamVjdC5jb25mbHVlbmNlLXByZXZpZXdzLnRlbXBsaW5rc3Jlc291cmNlIiwicXNoIjoiNzA3M2JmMmU1MThlYmRkY2IxZTU4M2I4ZGIwN2RlNWE4YTIzMzU1OTdhOTYyYjE4NjgxYjdiYjg3NTNkZWNhYSIsImlzcyI6ImNvbS5hdGxhc3NpYW4uY29uZmx1ZW5jZS5wbHVnaW5zLnByZXZpZXdzIiwiZXhwIjoxNTQyMzYyNzQxLCJpYXQiOjE1NDIzNjI2ODEsInVzZXJLZXkiOiJmZjgwODA4MTRjNzVlM2QzMDE0ZGY1ZjBmYTA0MDAyMCJ9.7nbb9CwVhNdf1UTmczwcgusYqD7niWB8KWAcGfpmiPU","applicationID":"3394eeeccfa6f14ee686c41069e48876","fileName":"test.txt","submitChangesURL":"","autoUpload":false}]},
{"namespace":"adc:file-manager","date":"2018-11-16T10:04:35.805Z","message":["download length set at ",2042]},
{"namespace":"adc:analytics","date":"2018-11-16T10:04:35.805Z","message":["event","companion.openWith.request",{"appName":"Editor","fileAttributes":{"fileSize":2042}},"7714c9bc-1136-459f-a60e-c10318133725"]},
{"namespace":"adc:file-manager","date":"2018-11-16T10:04:35.820Z","message":["telling the OS to launch file:","C:\\Users\\sk569140\\.atlassian-companion\\fd7606ad-4767-4ee7-8163-5c2f23a964f8\\test.txt"]}
]

The content of an Text File:

    <!DOCTYPE html>
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
        <meta content="width=device-width, initial-scale=1.0" name="viewport">
        <meta name="ROBOTS" content="index,follow" />

        <title>RWTH Single Sign On</title>

        <link rel="stylesheet" type="text/css" href="/idp/css/bootstrap.min.rwth.css">        
        <link rel="stylesheet" type="text/css" href="/idp/css/rzanwendungen-ver-F04DCB5F603C32D97AA42082EE944021.css">
        <link rel="stylesheet" type="text/css" href="/idp/css/shibboleth.css">

        <link rel="icon" type="image/png" href="/idp/images/favicon-16x16.png" sizes="16x16" />
        <link rel="icon" type="image/png" href="/idp/images/favicon-32x32.png" sizes="32x32" />
        
        <script type="text/javascript" src="/idp/js/jquery.min.js"></script>
        <script type="text/javascript" src="/idp/js/bootstrap.min.rwth.js"></script>
        <script type="text/javascript" src="/idp/js/shib.js"></script>
    </head>

    <body>
        <div id="kopf">
            <div id="blackbar">
                <a id="rwthlogo" href="http://www.itc.rwth-aachen.de"></a>
            </div>
            <div id="sprachauswahl">
                <div>
                    <a href="#" id="de" style="display: none;">Deutsch</a>
                    <a href="#" id="en">Englisch</a>
                </div>
            </div>
        </div>
        <div id="rahmen_ohne_menu">
            <div id="hauptnav_trennung"></div>
            <div id="inhalt_rahmen_ohne_menue">
                <div id="inhalt"><!-- BEGIN #inhalt -->
                    <div class="form-attr">
                        <h1>Ein Fehler ist aufgetreten.</h1>
                        <p>Ein Fehler ist aufgetreten: NoSuchFlowExecutionException</p>
                    </div>
                </div><!-- END #inhalt -->
            </div>
        </div>
        <footer class="footer">
            <div class="container">
                <p align="center">
                    <a href="https://www.itc.rwth-aachen.de/go/id/frnr" target="_blank">Sicherheitshinweise</a> <a href="https://doc.itc.rwth-aachen.de/display/SD/Home" target="_blank">Hilfe</a> <a href="https://maintenance.itc.rwth-aachen.de/?sort=status" target="_blank">Wartungsmeldungen</a>
                </p>
            </div>
        </footer>
    </body>
</html>

[Shannon S]

Stephan,

Yes, essentially it's an issue with the SSO provider not passing on the information correctly, and instead as HTML. 

The same issue was occurring on our own platform, Crowd, and has since been resolved, just to give you an idea of what needs to be corrected in Shibboleth:

• CONFSERVER-56444 Edit in App does not work when Confluence is integrated with Crowd SSO

I would recommend that you share the same details you did for me on the bug number CONFSERVER-57486. This can help us to determine how to avoid this issue in the future.

Thank you for your help!

Shannon

[Stephan Krinetzki]

Thanks Shannon,

i added a comment to the mentioned issue.