UniFi Identity Enterprise - Add Atlassian Cloud as an SSO App

After adding Atlassian Cloud as an SSO App in Identity Enterprise, you can leverage the SSO App feature for centralized and secured user lifecycle management.

Requirements

To get started, ensure that:

• Your organization has subscribed to Atlassian Guard Standard.
• You're an admin for an Atlassian organization. 
• Your domain has been verified with Atlassian. 
• You only need to set up SAML once even if you have two different Atlassian Cloud tenants (for example, one for Jira and one for Confluence) as long as your users have the same email address associated with both.

Add Atlassian Cloud App to Identity Enterprise

1. Go to your Identity Enterprise Manager > SSO Apps.
2. Click the Add icon on the upper right corner and select Atlassian Cloud.
3. Click Add. The Sign-On URL, Issuer, Fingerprint, and Public Certificate will be displayed. Do not close the page as you’ll need to copy and paste them in Atlassian when configuring SSO in Atlassian. 

Configure SSO in Atlassian

1. Sign in to the Atlassian admin console. 
2. Go to Security > SAML single sign-on and click Add SAML configuration. 
3. Fill in the required information:
   • Identity provider Entity ID: Paste the Issuer from Identity Enterprise Manager.
   • Identity provider SSO URL: Paste the Sign-On URL from Identity Enterprise Manager.
   • Public x509 certificate: Open the public certificate downloaded from Identity Enterprise Manager, copy the entire content, and paste it into the field.
4. Click Save configuration.

5. In the “Information required by your Identity Provider” section, copy SP Entity ID for later use.
6. You can refer to Configure SAML single sign-on with an identity provider for more details.

Configure SSO Settings in Identity Enterprise Manager

1. Navigate back to Add Atlassian Cloud Page in Identity Enterprise Manager.

2. Specify the following information:
   1. App name: Name this App.
   2. Display the following links: The selected links will be displayed in the users’ app gallery. 
   3. (Optional) Default Relay State: The SAML default relay state is the destination to which the user will be redirected after they have completed the authentication process at the Identity Provider (IdP).
   4. Unique ID: Paste the SP Entity ID from Atlassian Cloud.
   5. Jira Base URL: Enter your Jira Base URL, for example, https://[customer-name].atlassian.net
   6. Confluence Base URL: Enter your Confluence Base URL, for example,  https://[customer-name].atlassian.net/wiki (append /wiki at the end of the URL to land on the Confluence dashboard upon sign-in).
3. Click Add.

Test SSO Configuration

1. Ensure that you have a user account in both Identity Enterprise Manager and Atlassian Cloud that uses the same email. You can create a test user, or you can use your own account if you choose.
2. Assign the Identity Enterprise test user:
   1. Go to Identity Enterprise Manager > SSO Apps. 
   2. Select the Atlassian Cloud app and go to the Assignments tab.
   3. Click the Add icon, search, and assign a user to test. 
3. Make sure that you are signed out of Atlassian Cloud.
4. Test IdP-initiated:
   1. Sign in to Identity Enterprise Workspace using the test user’s account.
   2. Click Application in the left sidebar.
   3. Click Atlassian Cloud Jira or Atlassian Cloud Confluence. You should be signed in to Jira or Confluence.
5. Test SP-initiated:
   1. Open your Jira or Confluence sign-in page and enter the test user’s email address.
   2. You will be redirected to the Identity Enterprise sign-in page, enter the test user’s credentials, and sign in to Jira or Confluence.
6. If the test fails, see Troubleshoot your SAML configuration for details.