Can a user with a disabled account browse Confluence content anonymously?

Question

I'm running Confluence 3.5.13.

I've got SSO authentication against our Active Directory forest working using the NTLMv2 plugin from TechTime.

Users with an active account in Confluence are logged in automatically, and users with no account can browse spaces as anonymous. No problem here.

There is an issue, though, with users who have an account in the Confluence database which has been disabled. Whatever they try to access they get a page which says, "You are not permitted to perform this action".

My question is this: Is it possible to configure Confluence so that a person with a disabled account is able to browse as an anonymous user can?

Deleteing the user's account is not feasible due to references from content they have contributed in the past. They can log out, but as soon as they go to another page the SSO authenticates them again and they're denied access.

I think I need a way to give users with disabled accounts the "Use Confluence" global permission while maintaining their disabled status for other purposes.

I've posted theis question on Atlassian's forums as well, so the race is on for a good answer. ;-)

score 1 · Accepted Answer · answered Feb 05 '12 at 21:56

From Ed at TechTime:

It is possible to force IOPlex Jespa (the library that actually does NTLM authenticaton under the bonnet) to install an anonymous identitiy into the session on logout. This will prevent users from getting logged in again immediately after explicit logout, but it will also remove the possibility of logging back in again by just clicking on anything outside of logout page. If you do want to go this route, just add/change this in Jespa filter definition in web.xml:

<init-param>
  <param-name>http.parameter.anonymous.name</param-name>
  <param-value>logout</param-value>
</init-param>
<init-param>
  <param-name>http.parameter.logout.name</param-name>
  <param-value>logout</param-value>
</init-param>
<init-param>
  <param-name>fallback.location</param-name>
  <param-value>/login.action?logout=true</param-value>
</init-param>

This tells Jespa 3 things:

if you see logout parameter in the URL, do logout.

if you see logout parameter in the URL install anonymous identity

if for some reason authentication fails - go to login form and install anonymous identity while you are at it

From here I also added some code to notpermitted.vm to redirect to the logout.action, and also login.vm to redirect to the homepage on logout. It's a kludge, but Ed said they're going to update the plugin to not log a disabled user in.

Can a user with a disabled account browse Confluence content anonymously?

1 Answers1