Configure OKTA SAML single sign-on for portal-only customers

Summary

Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, such as an identity provider and a service provider.

SAML for single sign-on (SSO) allows customers to authenticate through the organization's Identity Provider (IDP) when logging in to the Jira Service Management Customer Portal. During an active session, customers need to log in only once to access multiple portals within a single Jira Service Management instance.

Customers outside the organization can only access the organization's Jira Service Management portal. Atlassian does not count these customers toward the Atlassian Guard subscription billing. Learn more about Jira Service Management customer accounts.

Pre-requisites

To configure SSO for JSM Portal-only customers, you need:

• Jira Service Management Portal

• Atlassian Guard Subscription

• Organization Admin role for the Atlassian organization

• Administrator role on OKTA

Set up SAML application in Okta

1. Log in to the OKTA Admin Portal

2. Go to Applications > Select Applications > Select Create App Integration > Select SAML 2.0

3. On the application creation page, add the application name and select Next

4. On the Configure SAML page, add the values and set the options as below

   • During the initial OKTA application setup, enter dummy values in all URL fields. These placeholder values will be replaced after you configure SAML on the Atlassian side.

   • Name ID Format: EmailAddress

   • Application username: Email

   • Update application username on: Create and Update

5. On the next screen, select Finish and complete the setup

6. From the OKTA Sign On tab, select View SAML setup instructions and copy these three values:

   1. Identity Provider Single Sign-On URL

   2. Identity Provider Issuer

   3. X.509 Certificate

Setup SAML on the Atlassian side

Log in to https://admin.atlassian.com. The steps will differ based on your user management experience.

The navigation path confirms which user management experience your organization uses. Follow the path that matches what you see.

After selecting the applicable path, continue with the existing sequence: select ••• (More) > Identity providers, select OKTA, enter a directory name, select Add, then select Set up SAML single sign-on.

Keep the three Atlassian-side fields adjacent to their corresponding OKTA values:

• Identity Provider Single Sign-On URL

• Identity Provider Issuer

• X.509 Certificate

1. From the IDP selection page, select OKTA

2. Provide any suitable directory name and select Add > Select Set up SAML single sign-on

3. On the next screen, paste all 3 values copied from the OKTA in the respective fields, then select Next

   • Identity Provider Single Sign-On URL

   • Identity Provider Issuer

   • X.509 Certificate

4. From the next screen, copy the Service provider entity URL and the Service provider assertion consumer service URL (to be updated on OKTA)

Update values on OKTA

The URL fields you populated with dummy values during the initial Okta app setup are replaced in this step. Overwrite the placeholder Single sign-on URL and Audience URI (SP Entity ID) with the real Service provider values you copied from the Atlassian side.

On OKTA IDP, for the JSM SSO Application, go to the General tab and select Edit within the SAML Settings box.

Go to Configure SAML and update the values as below:

1. Configure the attributes below under Attribute Statements:

   • Application Username (Name ID): Email

   • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

     • Name format: Unspecified

     • Value: user.firstName

   • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

     • Name format: Unspecified

     • Value: user.lastName

   • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn

     • Name format: Unspecified

     • Value: user.getInternalProperty("id")

2. Save and finish the setup.

Assign users/groups to the SSO application on JSM and test SAML Single Sign-On

Add users or groups to the assignment scope for the JSM Application in OKTA.

Then follow the existing test sequence exactly:

• On the Atlassian side, select Test single sign-on.

• Select Test single sign-on > Save settings.

• Select View testing steps.

• Password: Enable login with email and password

• Identity provider: Test single sign-on