Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to implement a Single-Sign-On solution using OpenSSO (express build 8) for the most recent versions of Jira (4.0.1) and Confluence (3.1) ? Is full integration of OpenSSO users and groups possible, or only integration on the level of authentication (which means that there is still a user store in both Jira and Confluence) ?

I already tried to find information about this, but this is still not clear to me. I found the Seraph provider extension for OpenSSO at

This one only provides authentication and gives pure SSO for Jira and Confluence AFAICT. Then I also found an extension for Jira which gives better integration with OpenSSO at

Does anyone have experience with those extensions and recent versions of Jira and Confluence?

I tried to install a setup with OpenSSO on a GlassFish server (with the default OpenSSO setup, since this is only a test) and Confluence on Tomcat 6.0.20. I use the Seraph provider, which can be found on the OpenSSO extensions page. I configured Confluence as described in the documentation. I use the following file:

As you can see, the property is true. This is also activated on the OpenSSO server side.

In the Confluence install, I initially created an admin user "confluenceadmin". I created a user with the same id in the OpenSSO user data store.

When I browse to the Confluence site (http://confluence.test.local:8080/), I am redirected to the OpenSSO login page (which is correct). After authentication on the OpenSSO page, however, the browser goes into a redirect loop between Confluence and OpenSSO. In the Tomcat logs, I found the following error on the Confluence side:

In SiteMonitor.isAvailable()
amNaming:01/06/2010 04:30:04:463 PM CET: Thread[http-8080-1,5,main]
SiteID http://opensso.pmtools.local:8080/opensso/sessionservice is UP.
PLLClient:01/06/2010 04:30:04:463 PM CET: Thread[http-8080-1,5,main]
sending cookies: iPlanetDirectoryPro=AQIC5wM2LY4SfczS5FTStE+TifKvZv90WatUK11Rea1JT28=@AAJTSQACMDE=#;amlbcookie=null
amSession:01/06/2010 04:30:04:467 PM CET: Thread[http-8080-1,5,main]
ERROR: XMLUtils.fatalError
org.xml.sax.SAXParseException: Content is not allowed in prolog.
 at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
 at org.apache.xerces.util.ErrorHandlerWrapper.fatalError(Unknown Source)
 at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
 at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
 at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
 at org.apache.xerces.impl.XMLScanner.reportFatalError(Unknown Source)
 at org.apache.xerces.impl.XMLDocumentScannerImpl$PrologDispatcher.dispatch(Unknown Source)
 at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown     Source)
 at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
 at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
 at org.apache.xerces.parsers.XMLParser.parse(Unknown Source)
 at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
 at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
 at javax.xml.parsers.DocumentBuilder.parse(
 at com.sun.identity.shared.xml.XMLUtils.toDOMDocument(
 at com.sun.identity.shared.xml.XMLUtils.toDOMDocument(
 at com.iplanet.dpro.session.share.SessionResponseParser.<init>(
 at com.iplanet.dpro.session.share.SessionResponse.parseXML(
 at com.iplanet.dpro.session.Session.sendPLLRequest(
 at com.iplanet.dpro.session.Session.getSessionResponseWithoutRetry(
 at com.iplanet.dpro.session.Session.getSessionResponse(
 at com.iplanet.dpro.session.Session.doRefresh(
 at com.iplanet.dpro.session.Session.access$300(
 at com.iplanet.dpro.session.Session$

Any hints on how to proceed?

BTW, I know Atlassian provides Crowd for central user management and Single-Sign-On. However, we'd like to standardize on OpenSSO.

share|improve this question
up vote 0 down vote accepted

You can optimize your Jira and Confluence with your A.D. , I recently integrated them. You can find integrator in Jira Admin Panel . But with my recommendation, you should prefer Crowd for SSO, It is easier to install and manage. I hope it will be helpful for you.

share|improve this answer
In the end, we gave up on OpenSSO and bought Crowd, which was much much simpler to setup. – rvdginste Mar 11 '10 at 20:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.