Enable default login page to bypass SAML in Confluence Data Center
This article applies to version 4.X.X of the SSO for Atlassian Data Center app. The version bundled with your version of Confluence may be different.
See documentation for older versions below.
Purpose
The SSO plugin supports a bypass parameter to login to Confluence directly without using your configured IDP. This query parameter, auth_fallback is disabled by default, works only on the login page URL, and is useful for troubleshooting SSO issues. An example of such a URL for Confluence is http://<base-url>/login.action?auth_fallback (e.g. http://confluence.com/login.action?auth_fallback). If the application is configured to allow bypassing SSO authentication, then users will be able to access the default login page directly by providing this parameter.
When using SSO for Atlassian Data Center app version 4.0.X or 4.1.X, you can also enable SSO bypass for all users and all URLs by setting the Login mode to Use OpenID Connect / SAML as secondary authentication in SSO 2.0 configuration. With this option enabled, all users will be able to log in through the default login page directly and will be able to log in through your IDP by going to https://<base-url>/plugins/servlet/external-login.
When using SSO for Atlassian Data Center app version 4.2.X, you can also enable SSO bypass for all users and all URLs by enabling the Show on login page for the Login Option "Username and password" in Authentication Methods configuration. This is possible as starting in v4.2.0, Multiple IdPs support was introduced.
Note that enabling this will mean that users are not automatically redirected to log in through your IDP when visiting Confluence, and may find this disruptive. To minimize disruption to active users, you may prefer the approach detailed below.
Method-1: REST API
In order to make use of this functionality, the allow-redirect-override flag (or enable-authentication-fallback flag, depending on the version) needs to be enabled via REST API. This can be done with other REST clients or via cURL, but the following is a user-friendly approach:
1. Download Postman for your browser (or use your own if you have an alternate REST client).
2. Open Postman.
3. Select GET from the dropdown menu and select Basic Auth from the Authorization tab (enter the admin credentials for Confluence).
Please bear in mind, the '
{"message":"Basic Authentication has been disabled on this instance."
4. Enter the following URL, modified for your environment: http(s)://<base-url>/rest/authconfig/1.0/sso (e.g. https://confluence.com/rest/authconfig/1.0/sso ).
5. This should return something like the following after clicking SEND if OIDC is configured:
{
"sso-type": "OIDC",
"redirect-on-login": true,
"allow-redirect-override": false,
"include-customer-logins": false,
"enable-remember-me": true,
"issuer-url": "https://<redacted>-testing.okta.com",
"client-id": "<redacted>gUe4x5",
"discovery-enabled": true,
"username-claim": "preferred_username"
}And an output like this if SAML is configured:
6. To do this, open a new tab in Postman.
7. Select PATCH from the dropdown and enter the URL http(s)://<base-url>/rest/authconfig/1.0/sso (e.g. https://confluence.com/rest/authconfig/1.0/sso ).
- Some versions of Confluence may return an error with 405 - Method Not Allowed when attempting this. In this case, use PUT instead of PATCH method or vice versa. Everything else below still applies.
If you see an error 415 - Unsupported Media Type client error, response code indicates that the server refuses to accept the request because the payload format is in an unsupported format. Ensure that under Header, Content-type is set to application/json.
8. Select Basic Auth from the Authorization tab and enter the credentials for the admin account.
9. Go to the Body tab, select raw from the radio buttons. Select JSON (application/json) from the dropdown menu.
10. Use the below JSON body to set the relevant parameter true:
11. You should get a 200 or 304 status when pressing the Send button.
12. You will now be able to access http://confluence.com/login.action?auth_fallback to bypass SSO. It's important to remember to set the flag back to false once the maintenance has been completed in order to restore the intended behavior. To do this, issue the same PATCH request, but with false instead of true.
13. Once this is done, verify that allow-redirect-override or enable-authentication-fallback is back to false by sending the same GET request to http(s)://<base-url>/rest/authconfig/1.0/sso described earlier.
Method-2: Database
The SSO configuration can also be checked directly in the database as well through the following query:
Method-3: Recover Admin User Rights
If none of the above methods did help you you may consider starting Confluence in recovery mode to recover your admin user rights. Please refer to the Restore Passwords To Recover Admin User Rights.
For app version 3.2 or earlier
If you're running SSO for Atlassian Data Center app version 3.2 or earlier, the steps are different.