Confluence Docs 3.0 : HTTP authentication with Seraph This page last changed on May 06, 2007 by don.willis@atlassian.com. ### Introduction This document describes how the default security system in Confluence works, using the Seraph library for HTTP authentication. Extending the security system by subclassing Seraph's authenticator and configuring the `seraph-config.xml` file is outside the scope of this document. See Single Sign-on Integration with JIRA and Confluence. ### Flowchart diagrams The easiest way to understand Confluence's authentication process is with the following diagrams. Authentication flowchart Because the `Authenticator.login(request, response, username, password, rememberMe)` method occurs three times, and is slightly complex, it has been broken into its own sub-flowchart. Login method flowchart ### Supported authentication methods The default Seraph authenticator supports four methods of authentication, as can be seen in the flowchart: request parameters: os_username and os_password session attribute storing the logged-in user cookie storing username and password ('remember me' login) HTTP basic authentication via standard headers. Each method is tried in the order above. A successful login at an earlier method continues without checking the later methods. Failure at one method means continuing with the later methods until all are exhausted. At this point, the user is considered an anonymous user, and treated according to the permissions of an anonymous user in Confluence. Looking through the source code will show that Seraph supports role-based authentication, but this is only used in Confluence for the `/admin/` URL restriction. ### Related pages Understanding User Management in Confluence Confluence Internals Single Sign-on Integration with JIRA and Confluence. Attachments: confluenceLogin.graffle (application/octet-stream) confluenceAuthentication.graffle (application/octet-stream) confluenceLogin.png (image/png) confluenceAuthentication.png (image/png) confluenceAuthentication.png (image/png) confluenceAuthentication.graffle (application/octet-stream)

Document generated by Confluence on Nov 05, 2009 23:34