Authentication for users using SAML

[Rory Davidson]

We are having a hard time setting up our Atlassian Cloud Confluence access for our users as we want them to authenticate through our own identity provider (Keycloak using SAML), with the identity provider initiating the SSO.

We thought that the accounts provided through our identity provider would be all that's needed, but it seems that users still need to create an Atlassian Account first. Is this true, as it seems to be contrary to us being able to provisioning our users in our Keycloak instance? We could well be missing something though!

Has anyone else been able to get Keycloak running as an identity provide for Atlassian Cloud products, if so, I'd be grateful for any tips that we should be looking into.

[Mia Tamm _Simpleasyty_]

Hi @Rory Davidson — this trips a lot of folks up.

Short answer: for Atlassian Cloud, everyone still signs in as an Atlassian account. SAML SSO (with Keycloak in your case) doesn’t replace the account model; it just handles the authentication.

The good news is you don’t have to pre-create accounts manually: with Atlassian Access and a verified domain, you can enable just-in-time creation so a managed Atlassian account is created on the user’s first SSO login. That usually removes the “please create an Atlassian account first” step you’re seeing.

If you also want lifecycle management (create/update/deactivate from Keycloak), that’s done via SCIM provisioning. Atlassian doesn’t ship a native Keycloak connector, so teams either use a SCIM bridge/plug-in or manage users in Atlassian Admin and rely on JIT.

A quick checklist that tends to resolve most setups:

• Verify your email domain in admin.atlassian.com and have Atlassian Access active.
• Configure SAML using the metadata/values shown in your org’s SAML settings (don’t copy generic examples). Ensure NameID maps to the user’s email.
• Turn on enforcement for SSO and (optionally) JIT account creation.
• Test SP-initiated login first (from a product URL) before trying IdP-initiated flows.

Keycloak works fine as the IdP with those pieces in place. If it helps, share a redacted screenshot of your attribute mappings and we can sanity-check them.

 — Mia Tamm from Simpleasyty

[Rory Davidson]

Thanks very much for your help. We'd already been trying to get SCIM working to be able to manage in Keycloak.

One follow-up question, or clarification, is that we are supporting a community where users have their own email domains. Does this mean we would need to verify every email domain, or is the answer to get SCIM working for this? 

[marc -Collabello--Phase Locked-]

No direct experience with Keycloak, however I know that many Atlassian customers also use third party addons for SSO.

[Rory Davidson]

Thanks. Do you know if this is identity provide initiated SSO without the need for the user to create an Atlassian account first? This is the part that is really confusing us.