Community
Q&A
Jira
Questions
How does Jira Data Center 11.3.7 identify and match users during SSO with Azure AD?

How does Jira Data Center 11.3.7 identify and match users during SSO with Azure AD?

Hi everyone,

I am configuring SSO between Microsoft Azure AD and Jira Data Center 11.3.7 using SAML.

I would like to understand how Jira identifies and matches the user attributes received from Azure AD during SSO. Specifically, when Azure AD sends user attributes such as username, user ID, and email address, which Jira user attribute does Jira use to compare and match the incoming SAML user with an existing Jira user?

Is the matching performed based on the Jira username, user ID, email address, or another attribute?

Also, is there any configuration in Jira Data Center that allows us to define which Azure AD SAML attribute should be used for user matching?

Any guidance or documentation on this would be greatly appreciated.

same thing in confluence also,

Thanks,

3 answers

1 accepted

1 vote

Answer accepted

Hi @Vinod M

Welcome to the Atlassian Community!

Jira will try to identify an existing local user based on the configured Username mapping in the SAML authentication method.

By default, this is commonly - ${NameID}

Jira evaluates that value from the SAML assertion and matches the resulting value against the existing Jira username. It doesn't automatically choose the email address or Entra ID object ID for matching.

You can check this under:

Administration → System → Authentication methods → SAML configuration → Username mapping

For example, if the existing Jira username is vinod.m

then the SAML username mapping must ultimately resolve to vinod.m. If Entra ID sends vinod@company.com as the mapped value instead, Jira won't match it to vinod.m.

You can also configure Jira to use a SAML assertion attribute instead of NameID if another Entra ID attribute contains the value matching your Jira usernames.

Atlassian documentations

https://confluence.atlassian.com/enterprise/saml-single-sign-on-for-atlassian-data-center-applications-857050705.html

https://confluence.atlassian.com/enterprise/howto-using-a-saml-assertion-attribute-as-the-product-username-945522510.html

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Hi @Gor Greyan
Thanks for the clarification.

I have one more question regarding the Username mapping. When Jira matches the SAML attribute value with the existing Jira user, does it compare against the user's Username field only, or can it also compare against the user's Full Name/Display Name?

For example, if a Jira user has:

User: vinod
Full Name: Vinod Raj
Email: vinod@company.com

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Hi @Vinod M

Yes, for the SAML login, Jira matches the value produced by the configured Username mapping against the user's Username, not their Full Name/Display Name.

Using your example, it will be.

Username:
Full Name: Vinod Rai
Email: vinod@company.com

If your SAML Username mapping resolves to.

vinod

Jira can match that to the existing user.

If it resolves to Vinod Rai, Jira will not match that value against the Full Name/Display Name as a fallback. The Display Name is not used as the account identifier for SAML authentication.

The same applies to the email address: Jira won't automatically try the email field if the configured Username mapping doesn't match the Jira username. If you want an Entra ID attribute such as email/UPN to be used for the mapping, its resulting value still needs to correspond to the username Jira expects for that existing user.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

1 vote

Hi @Vinod M

In DC , this is based on internal Username field by default.

See this article from documentation; saml-sso-for-jira-data-center-applications

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

0 votes

Hey @Vinod M ,

Can you just share how your users are provisioned? Are you using using Crowd or some third party app?

Also, are you using local AD or cloud Entra ID?

Cheers, Tobi

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Hi @Tomislav Tobijas

We are using the Jira Data Center internal user directory for user provisioning and management. We are not using Crowd or any third-party user provisioning application.

For authentication, we are using Microsoft Entra ID (Azure AD) in the cloud as the SAML Identity Provider. The users are maintained locally in Jira, while Entra ID is used only for SSO authentication. JIT provisioning is currently disabled.

when Azure AD sends the SAML user attributes to Jira and Confluence Data Center, which local user attribute does the application use to identify and match the user — the local username, user ID, email address, or another?

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Like • Tomislav Tobijas likes this

Suggest an answer

Was this helpful?

Thanks!

Jira

DEPLOYMENT TYPE

CLOUD

Forums

Q&A

Community resources

Support

Top groups

Community resources

Support

Learn

Community resources

Support

Events

Community resources

Support

How does Jira Data Center 11.3.7 identify and match users during SSO with Azure AD?

3 answers

1 accepted

Suggest an answer

Was this helpful?

Thanks!

DEPLOYMENT TYPE

TAGS

Community showcase

Atlassian Community Events