Jira 5.2 Seraph SSO登录反向代理

Question

几天后,我正在尝试为Jira 5.2启用SSO,并且发现,Jira的帮助页面已经过时了.

每个示例都使用旧版本的atlassian-seraph(Jira 5.2使用2.6.0).

目标: 如果我登录Webseal(反向代理),我想自动登录Jira.

背景:

• Jira是反向代理的背后(见图).
• 此代理验证用户并保持会话.
• 如果我已登录,我也希望登录Jira
• 提供的唯一信息是用户名

题:

如何编写自定义登录模块,从http_header读取用户名并验证用户身份？

链接:

• https://confluence.atlassian.com/display/DEV/Single+Sign-on+Integration+with+JIRA+and+Confluence
• http://docs.atlassian.com/atlassian-seraph/latest/sso.html
• https://answers.atlassian.com/questions/23245/how-to-integrate-jira-with-my-company-s-sso

Answer 1

最后我自己想通了:

1. 您需要一个自定义身份验证器

   public class MyCustomAuthenticator extends DefaultAuthenticator {
   
     protected boolean authenticate(Principal user, String password)
       throws AuthenticatorException {
       return true;
     }
   
     protected Principal getUser(String username) {
      return getCrowdService().getUser(username);
     }
   
     private CrowdService getCrowdService() {
       return (CrowdService)ComponentManager.getComponent(CrowdService.class);
     }
   }
   

2. 将MyCustomAuthenticator添加到seraph-config.xml

   <authenticator class="com.company.jira.MyCustomAuthenticator"/>
   

3. 编写自定义过滤器以从http-header设置用户名

   public class CustomFilter extends PasswordBasedLoginFilter {
   
       @Override
       protected UserPasswordPair extractUserPasswordPair(
           HttpServletRequest request) {
           String username = request.getHeader("iv-header");
   
           if (username != null && username.trim().length() != 0) {
               return new PasswordBasedLoginFilter.UserPasswordPair(
                   username, "DUMMY", false);
           }
           return null;
       }
   }
   

4. 替换web.xml中的过滤器

   <filter>
      <filter-name>login</filter-name>
      <filter-class>com.company.jira.CustomFilter</filter-class>
    </filter>
   

Jira 5.2需要这些罐子

• 嵌入式人群API-2.6.2
• JIRA核-5.2.1
• Atlassian的,六翼天使-2.6.0