Jira Service Management integration/connection with OKTA

[vcatl2020]

This is with regards to connecting Jira Service Management (AGC) with OKTA via Automation rules utilizing web service calls.

Does a static Okta API token (SSWS) would simplify implementation and work natively with JSM Automation is a best approach? 

Alternately, Is it recommended to proceed with the OAuth JWT method and introduce a lightweight middleware service to:

1. Generate and sign JWTs
2. Retrieve access tokens from Okta
3. Provide tokens to JSM Automation at runtime

 Link: https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#create-and-sign-the-jwt

This service is to automate the provisioning and deprovisioning of users from JSM portal onboarding/offboarding request forms. Note that an SSO is enabled using OKTA for accessing JSM.

[Andrea Robbins]

I have implemented this before with the Okta automation integration: 

https://support.atlassian.com/cloud-automation/docs/use-automation-with-okta/ 

How this looks like:

1. If you have the employee email address, use the create a user action

2. After, retrieve the user's details (id specifically from Okta) using the get user details action

3. Add the user to the appropriate groups in Okta that provide the application access required

In case there's anything custom you need to do, you can use the Send custom Okta request option where you can do a custom REST API call.

Hope this helps!

Andrea

[Andrea Robbins]

Please note this automation connection with Okta is totally separate than what you are using in the provisioning of users for SSO through Atlassian Guard. 

[vcatl2020]

Thanks @Andrea Robbins for sharing this support Atlassian article. Does this automation connection works for Atlassian Gov Cloud customers who are using OKTA (IDP) SSO for provisioning of users and NOT Atlassian Guard?

[vcatl2020]

Does JSM Automation Rules has the capacity to provide a programmable execution environment capable of performing cryptographic operations (e.g. JWT Signing), managing OAuth token lifecycles, or acting as full OAuth Client?

[Andrea Robbins]

That's a great question if it is supported for government cloud customers. I do not see any note on the Atlassian documentation about this, but I have not tried it or seen it before within a government cloud site, so I could not answer for sure.

Sadly, Atlassian doesn't provide any sort of limitations on what the custom action can or cannot do, but if you know there are Okta endpoints (HTTPS REST API endpoints only) available for this, the "Send custom Okta request" should work, but it is not documented which do and possibly do not work.

You can think of this like a send web request but just for Okta, so the authentication is managed through the connection vs the authentication headers.

If you end up trying this and get it to work, it would be awesome if you wrote an article on this to share with other community members as not many have tried what you are attempting to do!

[Prabhu Palanisamy _Onward_]

Okta integration using automation rules will be much easier if you store data from Okta into Assets. This way you can look up user, current license assignments, roles etc and then use it for new hire onboarding Workflow logic. E.g when you provision a user, you may need department code that may not be available in the ticket. Looking up using Assets will simplify enable automations easily.

[vcatl2020]

Yes , we are looking to utilize Assets module in the future state after setting up this integration connection successfully

[Prabhu Palanisamy _Onward_]

Great approach. OnLink supports Okta import to Assets. Documentation Link.

Disclosure: I'm part of Onward who built OnLink.