Question about Confluence Server Knowledge Ingestion Setup

Question

We're setting up Confluence Server knowledge ingestion with Moveworks. Our Confluence instance is on-prem and only reachable internally. We've configured the built-in connector and confirmed connectivity via the API Playground in Setup and we get a successful response.

We also have the on-prem agent deployed in our sandbox environment, which is where we've been testing this setup.

Two questions for the community:

1. Does the on-prem agent eliminate the need for an MFA exception on the service account?

The access requirements doc lists two suggestions for setup, an exception policy at the IAM provider level, or a firewall exception for Moveworks IP ranges but does not specify if one is sufficient or both are needed. However, it also states that the agent is required for Confluence Server integration and that "no firewall changes are needed" when the agent is in use. Are the API calls being routed through the agent; which is why the API Playground calls are working or is the MFA exception still needed?

2. Is the API Playground success a reliable indicator that the MFA path is clear?

We're getting a successful response in the API Playground in Moveworks Setup. Is that test representative of how the actual ingestion crawl authenticates through the agent, or could the crawl hit a different auth path that would still trigger MFA?

3. How does the ingestion cycle work for Confluence Server, and what would be the impact on the on-prem instance?

Our admins are concerned about the crawl putting load on our Confluence instance. We understand that ingestion cadence is not customer configurable, but we'd like to understand: Does Confluence Server do incremental/delta ingestion for both articles and user permissions, or does every cycle do a full crawl? How frequently do full ingestions run vs. deltas?

4. Is there any configuration required to be set up in the on-prem agent?

The documentation didn’t mention about setting up anything in the Moveworks agent but says we need it set up.

Any guidance from those who've completed this setup — especially with an internal-only Confluence instance and the on-prem agent — would be greatly appreciated.

rgeroulo · Answer

Hi ​@Joel.Matias!1. Does the on-prem agent eliminate the need for an MFA exception on the service account?The on-prem agent is just a proxy that routes API calls from Moveworks (cloud) to your on-prem systems. The piece that determines if you need an MFA exception is the type of auth you use:Basic Auth — the username and password of a Confluence service account. Recommended for most deployments. This will require a MFA exception.API Key — a bearer token, sent as Authorization: Bearer <token>. Use an Atlassian personal access token, available from Confluence Data Center 7.9 and later. A personal access token avoids the MFA and SSO problems that basic authentication runs into, so prefer it when your version supports it.If your API calls are working, then I would assume you are using an API Key on the on-prem agent, hence not needingany MFA exception.2. Is the API Playground success a reliable indicator that the MFA path is clear?Yes, the API Playground can be used to simulate connectivity and the exact API calls that Moveworks would be making.3. How does the ingestion cycle work for Confluence Server, and what would be the impact on the on-prem instance?Typically, a full ingestion will run every 4 hours to update Confluence content. Please work with your Customer Success team as they should be able to help update this time frame. It is not available within Moveworks Setup currently, but this cadence could be updated to daily if needed.4. Is there any configuration required to be set upin the on-prem agent?The On-Prem Agent Installation Guideoutlines how to make updatesto the on-prem agent. This agent would need to be configured with a rest_config that holds your Confluence credentials. If this is not done already and you are seeing successful API Playground calls, then that would mean you are actually connecting to the Confluence instance over the internet. If this is indeed configured and your Confluence Connector is using On-Premise as the auth type, then that means you are proxying requests through the agent.Let me know if you have any other questions!Ryan

Sign up

If you're a Moveworks customer, you can click the SSO button below to login-even if it's your first time. Everyone else can use email or click create an account above to register.

Login or create an account

If you're a Moveworks customer, you can click the SSO button below to login-even if it's your first time. Everyone else can use email or click create an account above to register.