Hi everyone,

This issue has been open for 12 years, and as of April 2015 we still have no plans to support NTLM authentication natively in JIRA. We do plan to continue investing in improving support for external directory configurations in JIRA, however we want to focus on improving our support for the current set of configurations.

Regards,
Dave Meyer
dmeyer@atlassian.com
Product Manager, JIRA Platform

The easiest way to achieve NTLM authentication is to use CNTLM which is available for both Windows and Linux. You then configure the CNTLM service/daemon to connect to your NTLM proxy and you configure Jira to connect to your new CNTLM service/daemon. CNTLM proxies your requests including the appropriate NTLM authentication that allows Jira to communicate with the outside world. No extra plugins like has been suggested above are required and I have this working for several applications including Jira.

You can grab CNTLM from http://cntlm.sourceforge.net/ or if you are on Linux you might already have a package for it you can install from your repository.

JIRA customers interested in NTLM integration might find value from the NTLM Authenticator for JIRA, which is a plugin that is developed by an Atlassian Expert from New Zealand.

They state on their website: "We have customers successfully using this plugin in New Zealand, Australia, Europe and North America both in NTLMv1 and NTLMv2 environments with Confluence 3.x and 4.x, Jira 3.x, 4.x and 5.x", which suggests this would make a reliable solution for customers who want an SSO solution that logs them into JIRA directly from their Desktop logins.

Currently, the NTLM integration can be only achieved with help of a third-party plugin NTLM Authentication. Since the plugin was written by a third party developers, Atlassian does not provide any support to this extension.

http://confluence.atlassian.com/display/Support/How+to+Get+Legendary+Support+from+Atlassian

You may wish to post your question in the community supported forums.atlassian.com as someone might know a workaround the compatibility problem.

Regards,
Bogdan

Hello,

we have been successfully using ntlmauth4jira on JIRA 3.10.2 for quite some time now. Upgrading to Jira 4.0 or 4.0.1 is not a very attractive option at the moment - our attempts to get this plugin running on 4.0.1 failed miserably.

Please give us a status regarding this topic. Is ntlmauth4jira indeed abandonware as the previous speaker assumes?

Are there any other options? SSO via NTLM is crucial.

Best regards,
Bruno

Hello,

The ntlmauth4jira plugin hasn't had any updates for quite some time now & is starting to look like abandonware. Is there any new view from Atlassian if they will support NTLM authentication?

Is it a "no & we never will", "maybe", or something else?

Trying to fix a couple of bugs but we're having some trouble

Dom,

I've replied on the Confluence page.

I just added this to http://confluence.atlassian.com/display/JIRAEXT/NTLM+Authentication.. I'm not sure which site is active so I'm posting this here as well. I hope someone can help.

Hello... I have a major problem. We are using both AD accounts and local jira accounts. The local jira accounts authenticate fine but when we go to add comments using a local account we get a system error: com.atlassian.jira.exception.IssueNotFoundException: Issue with id 'null' or key 'null' could not be found in the system

this is repeatable with all issues across all projects, not just one in particular. This only happens using IE 6. Firefox works fine.

I've done some research and it seems to be a session timeout or not logged in error, but I know I'm logged in and there is no way the session timed out that quickly.

we're running jira 3.7.4 standalone enterprise on windows 2k3 using java 1.5.0_08 and ntlmauth 0.5.2

Please help.

Thanks!

-Dom

Thanks for the advice. I actually got more information about the missing class:
java.lang.NoClassDefFoundError: com/atlassian/seraph/filter/LoginFilter

This class is part of the seraph jar file located in the WEB-INF/lib. The requested file is in this directory. So it's just like WebSphere could not find it. I tried to put the jar file in the lib directory of WebSphere and I did get the same error: another opensymphony class could not be found. This is another classpath problem in WebSphere but I just cannot figure out the reason why it disappears as soon as I disable the NTLM filter in web.xml...

Any idea ?

Bruno

Running Websphere with -verbose:class might show up what class it's missing.

Hello,

I have successfully tested the NTLM extension for JIRA running on a Tomcat server. Unfortunately I can't make it work on WebSphere 5.1 (which is the production environment of my customer). I get the following error when trying to access the application:

2007-05-14 14:53:04,906 Servlet.Engine.Transports : 2 ERROR [500ErrorPage] Exception caught in 500 page Filter [login_ntlm]: ro.softwin.elearning.jiratools.NTLMLoginFilter was found, but is missing another required class.

javax.servlet.ServletException: Filter [login_ntlm]: ro.softwin.elearning.jiratools.NTLMLoginFilter was found, but is missing another required class.

at com.ibm.ws.webcontainer.filter.WebAppFilterManager.loadFilter(WebAppFilterManager.java:304)
at com.ibm.ws.webcontainer.filter.WebAppFilterManager.getFilterInstanceWrapper(WebAppFilterManager.java:161)
at com.ibm.ws.webcontainer.filter.WebAppFilterManager.getFilterChain(WebAppFilterManager.java:208)
at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.handleWebAppDispatch(WebAppRequestDispatcher.java:1003)
at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.dispatch(WebAppRequestDispatcher.java:529)
at com.ibm.ws.webcontainer.webapp.WebAppRequestDispatcher.forward(WebAppRequestDispatcher.java:208)
at com.ibm.ws.webcontainer.srt.WebAppInvoker.doForward(WebAppInvoker.java:134)
at com.ibm.ws.webcontainer.srt.WebAppInvoker.handleInvocationHook(WebAppInvoker.java:321)
at com.ibm.ws.webcontainer.cache.invocation.CachedInvocation.handleInvocation(CachedInvocation.java:71)
at com.ibm.ws.webcontainer.srp.ServletRequestProcessor.dispatchByURI(ServletRequestProcessor.java:246)
at com.ibm.ws.webcontainer.oselistener.OSEListenerDispatcher.service(OSEListener.java:334)
at com.ibm.ws.webcontainer.http.HttpConnection.handleRequest(HttpConnection.java:56)
at com.ibm.ws.http.HttpConnection.readAndHandleRequest(HttpConnection.java:652)
at com.ibm.ws.http.HttpConnection.run(HttpConnection.java:458)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:937)

I have activated the DEBUG mode in log4j.properties but there's unfortunately nothing more than the previous lines.

I wondered if this might be due to the fact that JIRA was not configured yet. Since WebSphere generates internal Ids in web.xml, it is actually mandatory to modify the filter section before deploying the archive. Once the application is deployed you get the following lines in

C:\WebSphere\AppServer\installedApps\ovwdjir01\atlassian-jira-3_7_4_warNTLM.ear\atlassian-jira-3.7.4.war\WEB-INF\web.xml

and

C:\WebSphere\AppServer\config\cells\ovwdjir01\applications\atlassian-jira-3_7_4_warNTLM.ear\deployments\atlassian-jira-3_7_4_warNTLM\atlassian-jira-3.7.4.war\WEB-INF\web.xml

<filter-mapping id="FilterMapping_1178808038066">
<filter-name>login_jira</filter-name>
<url-pattern>/rpc/*</url-pattern>
</filter-mapping>-->

<filter-mapping id="FilterMapping_1178808038066">
<filter-name>login_jira</filter-name>
<url-pattern>/rpc/*</url-pattern>
</filter-mapping>

Any idea of how to make this stuff work on WebSphere ?

Thanks.
Bruno

I've uploaded a new version to the plugin's page at http://confluence.atlassian.com/display/JIRAEXT/NTLM+Authentication , it should work with JIRA 3.6 and 3.7. This release is JIRA-only for now.

Cheers,
-Daniel

With JIRA 3.7.x the plugin written by Daniel does not fully work - see http://confluence.atlassian.com/display/JIRAEXT/NTLM+Authentication?focusedCommentId=8585582#comment-8585582, It would be great if Atlassian could finally take over responsibility for this plugin (or just its functionality) and ensure maintaining its compatibility with their evolving JIRA code base.
Having NTLM for JIRA is a great thing in corporate intranets.

Regards,

Wojtek

Hi, I'm using a version of this modified to work with Confluence (http://svn.atlassian.com/fisheye/viewrep/public/contrib/confluence/ntlm-authenticator). However, occassionally something happens and users are re-directed to the login screen. The only way to log in is to delete the username@confluence.domain cookie, re-start the browser and start again.

The contents of the cookie is:
confluence.browse.space.cookie
space-pages
wiki.snowyhydro.com.au/
1024
2144049536
29889434
4272235856
29817014
*
confluence.list.pages.cookie
list-recently-updated
wiki.snowyhydro.com.au/
1024
2144049536
29889434
4272235856
29817014
*

There is nothing in the logs except:
2006-10-30 11:16:48,332 ERROR [softwin.elearning.jiratools.NTLMWebHelper] doNTLM logon failed: Access is denied.

Interestingly, there is not cookie till this error occurs.

Does anyone know what is happening?

Wow!

I stopped tracking this issue years ago as the need disappeared. I never got any notification e-mails at all. Great to see things moving forward and that I finally started to get e-mail notifications

Nice work Daniel!

What is the status for this plugin?
Does anyone have it working for Jira 3.6.x?

Any news? I got some partial success accessing through "NTLM Authorization Proxy Server" (but not enough for jira dashboard to work successfully though ;-( )

I'm currently working on this. A new release should be available next week, or the week after at the latest.

Is there a way of getting this filter to 'play nice' with RPC calls? I can't get things like the eclipse jira-dashboard to work because it won't authenticate me..

Hi RefuX,

Atlassian currentoy does not support this implementation. Maybe the best place to get help is to add a comment on:
http://confluence.atlassian.com/display/JIRAEXT/NTLM+Authentication

Thanks,
Anton

Using JIRA 3.5
I get this:
2006-03-29 22:53:17,308 ERROR [softwin.elearning.jiratools.NTLMWebHelper] logon failed: Invalid access to memory location.

When I try to log in.

Daniel,
please add your source and the binaries in a "standard" zip-file under "Attachments" in Confluence, http://confluence.atlassian.com/display/JIRAEXT/NTLM+Authentication. Not all users and companies have a bz2 uncompress tool installed.

Daniel,

AT the moment there are no concrete plans due to the large number of other popular feature requests. Please refer to the following document whihc explains the way we implement new features:
http://confluence.atlassian.com/display/DEV/Implementation+of+New+Features+and+Improvements

Thanks,
Anton

Any plans to officially add this or something like it into the code base?

Hi,

Thanks for the support.

I'll think a give it a try, I'm not a Java guy only MS with dotnet.

But the functionality of Jira and Confluence is just great! To bad that
there is no SSO if both tools are combined.

Regards! Eric

Met vriendelijke groet,

Eric Spijk

ing. E. Spijk
IT4mation Solutions BV
Schellingweg 19N
1507 DR Zaandam
Telefoon 075 670 43 52
Fax 075 670 43 26
www.it4mation.nl

I believe the distributed .jar in ntlmauth4jira 0.5 was compiled with jdk 1.5.
You should be able to compile the sources with 1.4 against JIRA 3.4.1, though.

Hello,

I've installed the 0.5 version with the latest version of JIRA 3.4.1 (enterprise) but it comes with the following error(s):

2005-12-01 11:02:55,156 ERROR [ContainerBase.[Catalina].[localhost].[/jira]] Exception starting filter login
java.lang.UnsupportedClassVersionError: ro/softwin/elearning/jiratools/NTLMLoginFilter (Unsupported major.minor version 49.0)

any idea?

Regards Eric

Works just fine, thank you.

Thanks. With luck the following should now work:

export CVS_RSH=ssh
export CVSROOT=:ext:dpavel@cvs.opensource.atlassian.com:/cvsroot/atlassian-os
cvs checkout ntlmauth4jira

If you have problems please run 'cvs -t checkout ntlmauth4jira' and paste the output.

Ok, here's my public key:

---- BEGIN SSH2 PUBLIC KEY ----
Comment: "dsa-key-20050912 cvs-ssh-atlassian-jira-daniel.pavel"
AAAAB3NzaC1kc3MAAACBAJaFwIJ9qGHv3KimQpB4t5tsPbutmuacCKuBVp/3Aafx
L4es8qONRQiVwjAm9ndx5C/Mu2jieBTlKWUgrQzl1oH9GlqvpmgAFSwZQ43/FFhN
FUPZPOgsE/jMcQy74XGBUK49WV4zGxEX5RTkXY7fw8NMQv5qn/sfJHtbD+B9GY+P
AAAAFQDDfShApVM+ApWmYWcBQfGkq9pRlQAAAIA670WayM6vg1c97xttfxGd9unU
PMvCBzJXpyiSNPLx+O6nUJU+kvb+oWjNXc0gU6qyZPAlABR2jdtYFrssoLc0/gJa
D4lEYKzH3x3zwWZ4zBXtta5PzFarE+4e298BlD4djxgaJoCWXVcFt+zH+7iMYAMa
ery5IT/4qx4YZa8BOAAAAIBkCZL4a/Vtu4718o58Pp0c5ElnwVIMj+RSOrD62M3A
pZJLh18uPO0VMbCvTIH0y5/sbr3HqwOWaGujsjCkpIhk3mqmVfWqVPwasV2xLRJM
Mfi84NNIxPB96iEV95xCE4JW53i9VLE4d9eZtCZ1GdjFHTflzqcBl8Tktt2yFPQ6
aQ==
---- END SSH2 PUBLIC KEY ----

> Yeah, sure.
> Does your cvs server support cvs+ssh, or just plain pserver?

cvs+ssh. We'll have to do it with public keys. Please could you paste your ~/.ssh/id_dsa.pub or ~/.ssh/id_rsa.pub here. If you don't have one, please generate with:

ssh-keygen -t dsa

You can set a blank passphrase if you're happy with the security of your machine, or set a passphrase and use something like http://www.sshkeychain.org to store it in memory.

Cheers,
Jeff

Hey, that's nice , thanks. Always wondered what maven was about, but was
too lazy to get started with it. Maybe I'll even write proper unit tests
now .

Yeah, sure.
Does your cvs server support cvs+ssh, or just plain pserver?

-Daniel

–
"I love deadlines. I especially like the whooshing sound they make as they
go flying by."
– Douglas Adams

Thanks Daniel,

I've attached a project.xml and project.properties file which when placed in the project root, allow this to be built with Maven (http://maven.apache.org/). See build output pasted below.

Would you like to store this in a new CVS module on cvs.opensource.atlassian.com? We could then integrate it into our nightly JIRA build, to catch API incompatibilities early. Let us know if you're interested, and I'll create a module + account.

Cheers,
Jeff

jturner@teacup:~/dloads/ntlmauth4jira-0.5$ maven jar
__ __

Directory /home/jturner/.maven/repository does not exist. Attempting to create.
Attempting to download jcifs-1.2.3.jar.
253K downloaded
Attempting to download atlassian-jira-3.3.1.jar.
alert done
3278K downloaded
Attempting to download seraph-0.7.10.jar.
48K downloaded
Attempting to download oscore-2.2.5.jar.
87K downloaded
build:start:

java:prepare-filesystem:
[mkdir] Created dir: /home/jturner/dloads/ntlmauth4jira-0.5/target/classes

java:compile:
[echo] Compiling to /home/jturner/dloads/ntlmauth4jira-0.5/target/classes
[javac] Compiling 9 source files to /home/jturner/dloads/ntlmauth4jira-0.5/target/classes

java:jar-resources:

test:prepare-filesystem:
[mkdir] Created dir: /home/jturner/dloads/ntlmauth4jira-0.5/target/test-classes
[mkdir] Created dir: /home/jturner/dloads/ntlmauth4jira-0.5/target/test-reports

test:test-resources:

test:compile:
[javac] Compiling 1 source file to /home/jturner/dloads/ntlmauth4jira-0.5/target/test-classes

test:test:

jar:jar:
[jar] Building jar: /home/jturner/dloads/ntlmauth4jira-0.5/target/jira-ntlmauth-0.5.jar
BUILD SUCCESSFUL

ntlmauth4jira version 0.5

Changes:

• detect proxy, and fail accordingly
• new "domainController" setting
• removed 'defaultDomain' setting – can be guessed when there is only one domain, and makes things more confusing when there are more domains configured
• a test class for DC connectivity
• a bit of decoupling went on between the NTLM and Jira parts of the code
• some small bugfixes

ntlmauth4jira, release 0.4

Changes:

• fixed IE authentication – some pages with POST forms did not work
• new option to perform the Jira logon without rewriting passwords – might not always work, see the README
• (Costin Miroslav) better detection of the proper network interface to bind jCIFS to
• avoid getting users' domain account locked from typing a bad password (multiple NTLM attempts with the same bad password)
• some code refactoring and bugfixes

Archive contains (besides sources) the required jcifs library (1.2.0), and a compiled jar of ntlmauth4jira (JDK 1.5.0, against JIRA 3.2.1).

Excellent, thanks Daniel!

Some minor changes & fixes.
Built against Jira 3.2.
Updated build script to not depend on libraries' versions.

Nice work Daniel,
If you want, you can post this code on the JIRA Extensions space (http://confluence.atlassian.com/display/JIRAEXT/Home

I've played a bit with NTLM authentication in Jira. This is what came out.
Details and installation instructions available inside the archive.

Cheers,
-Daniel

From a user:

> I've just installed JIRA standalone to play with to see if it would be a good tool for us. Has anybody integrated Jcifs windows authentication with it? Would it be feasible/doable?
>
> http://jcifs.samba.org/src/docs/ntlmhttpauth.html