How does Jira Data Center 11.3.7 identify and match users during SSO with Azure AD?

[Vinod M]

Hi everyone,

I am configuring SSO between Microsoft Azure AD and Jira Data Center 11.3.7 using SAML.

I would like to understand how Jira identifies and matches the user attributes received from Azure AD during SSO. Specifically, when Azure AD sends user attributes such as username, user ID, and email address, which Jira user attribute does Jira use to compare and match the incoming SAML user with an existing Jira user?

Is the matching performed based on the Jira username, user ID, email address, or another attribute?

Also, is there any configuration in Jira Data Center that allows us to define which Azure AD SAML attribute should be used for user matching?

Any guidance or documentation on this would be greatly appreciated.

same thing in confluence also,

Thanks,

[Marc -Devoteam-]

Hi @Vinod M 

In DC , this is based on internal Username field by default.

See this article from documentation; saml-sso-for-jira-data-center-applications 

[Gor Greyan]

Hi @Vinod M

Welcome to the Atlassian Community!

Jira will try to identify an existing local user based on the configured Username mapping in the SAML authentication method.

By default, this is commonly - ${NameID}

Jira evaluates that value from the SAML assertion and matches the resulting value against the existing Jira username. It doesn't automatically choose the email address or Entra ID object ID for matching.

You can check this under:

Administration → System → Authentication methods → SAML configuration → Username mapping

For example, if the existing Jira username is vinod.m

then the SAML username mapping must ultimately resolve to vinod.m. If Entra ID sends vinod@company.com as the mapped value instead, Jira won't match it to vinod.m.

You can also configure Jira to use a SAML assertion attribute instead of NameID if another Entra ID attribute contains the value matching your Jira usernames.

Atlassian documentations

https://confluence.atlassian.com/enterprise/saml-single-sign-on-for-atlassian-data-center-applications-857050705.html

https://confluence.atlassian.com/enterprise/howto-using-a-saml-assertion-attribute-as-the-product-username-945522510.html

[Tomislav Tobijas]

Hey @Vinod M ,

Can you just share how your users are provisioned? Are you using using Crowd or some third party app?

Also, are you using local AD or cloud Entra ID?

Cheers, Tobi

[Vinod M]

Hi @Tomislav Tobijas 

We are using the Jira Data Center internal user directory for user provisioning and management. We are not using Crowd or any third-party user provisioning application.

For authentication, we are using Microsoft Entra ID (Azure AD) in the cloud as the SAML Identity Provider. The users are maintained locally in Jira, while Entra ID is used only for SSO authentication. JIT provisioning is currently disabled.

when Azure AD sends the SAML user attributes to Jira and Confluence Data Center, which local user attribute does the application use to identify and match the user — the local username, user ID, email address, or another?