SAML SSO for Jira/Confluence (Server) with PingIdentity

[Stefan Salzl]

Dear Atlassian-Community,

I´ve got a very special requirement and tbh. I´m overwhelmed with information I´ve found so far and (also because of lack of the deep technical knowledge) I can´t provide a dedicated answer.

The situation and requirement one of my customers is comming up with looks as follows:
They have Jira & Confluence Server. The internal main ID provider is PingIdentity which will be connected to their Active Directory and provide a Ping-Directory (which, as far as I understood that right will just replic the AD and is for authentication --> please correct me if I´m wrong).

They want to have SSO (with SAML or OAuth) for both Confluence and Jira but the authentication should be handled via the above mentioned IdP (Ping). 

Could anyone give me advice how this could be done? What´s the best way to do? Do I sill have to have the users in Jira/Confluence then? or is it sufficient to have them in the ping directory? or is there any automatic provisioning needed?

One more thing: Does installing crowd help in this sceneraio? As far as I understood crowd would be the Atlassian native tool to offer SSO on Server/DC. It seems to me that it would then be just another tool in between that would be capable of doing authentication but instead I´m using PingIdentity for this. From my point of view Crowd would then be redundant.

Looking forward to your answers/advices/best practices/explanations.

Best
Stefan

[Andrew Laden · Accepted solution]

I have been using EasySSO for a number of years and it has worked well for me. 

https://marketplace.atlassian.com/apps/1212581/easy-sso-jira-kerberos-ntlm-saml?hosting=server&tab=overview

[Lokesh Naktode_miniOrange · Accepted solution]

Hi Stefan,

You can integrate Jira and Confluence directly with Ping Identity for SAML SSO with user provisioning. Since you are using the server version, you need to set up SSO using the third-party SSO plugins available on the Atlassian Marketplace. The Jira and Confluence's DC version has a built-in SSO functionality.

Most SSO plugins offer "Just-in-time user provisioning," which automatically syncs all changes made to a user's profile (including groups) in Ping Identity to Jira and Confluence at each login (SSO login).

I work for the miniOrange, please take a look at the SSO plugin from miniOrange, which is easy to set up and provide a lot of flexible option to sync user details from Ping to Jira and Confluence. With this plugin, you will be able to manage users and groups directly from the Ping Identity.

In case, you need any assistance with the setup, please reach out to miniOrange support.

Thanks,
Lokesh
PS- I work for miniOrange, one of the top SSO vendors in the Atlassian marketplace.