ADFS Signle Sign On (SSO)

[Dhaval Mistry]

Hi, 

I am using JIRA on premises version. We used to logged in into jira using ADFS (Active directory) login 

We develop custom tools to connect jira and import issue from excel. it was working fine. 

Now, we move to DMZ server (public domain) , this DMZ server is outside our intranet and now when I pass my ADFS credential to DMZ server, DMZ server try to connect ADFS but due to security reason jira server unable to connect my org. AD server. due to that I am getting "Unauthorized (401)" error.

Same time, I notice, within VPN I can access jira thru web browser like chrome, IE, etc. 

I have learnt, when I try to access my jira thru chrome, we have SSO plug-in install on JIRA. which connect to ADFS as I am in VPN and get authenticated myself. I guess after connecting to ADFS, I got some kind of token which token web browser pass it to JIRA server. JIRA server send me positive response. 

Correct me if understanding is not correct. if its correct. Can I use SSO with my custom tool? How can I implement SSO within my custom application which connect JIRA. 

-Dhaval M.

[Daniel Eads]

Hi Dhaval,

I'm not totally sure where your custom application is running... On your Jira Server which appears to be in the DMZ? Somewhere else?

At any rate, if you're trying to use a non-Atlassian application with ADFS, you'll need to use a compatible plugin for that application or build your own SAML relying party in if it's an application you've built yourself. You can generally find these things by googling "SAML ________" (fill in the blank with the application you're using or the programming language you've used).

The application you've got should have access to your ADFS server to do the SAML dance. Microsoft has a fair amount of documentation for ADFS specifically and you can do some general reading on how SAML works. ADFS is the SAML Identity Provider in this situation and Jira and whatever other application you have are the Relying Parties. For services that are exposed to the internet, it's also a good idea to have your ADFS server exposed to the internet through a proxy so that folks can actually get logged in to the applications they're trying to use.

If you need to do some sort of authorization between your other application and Jira (and you don't already have something set up), OAuth is the way to go. Check out our documentation on OAuth for more information. Note that is is separate from your ADFS server!

Cheers,
Daniel