Unable to login Atlassian site with Admin account post SAML integration with Azure AD.

[Satish Shekhar Singh]

Hi All,

While configuring the JIRA cloud app with Azure AD as SAML 2.0 integration we verified our domain at Atlassian side. The Domain got verified.

Post that we configured JIRA-Cloud with Azure AD using SAML plugin , SSO started working and we are now able to access the application seamlessly with Azure AD ids and with same domain verified earlier.

But unfortunately we are not able to access the Atlassian site with Admin credential as it have the same domain and gets redirected to IDP login  page everytime.

The admin ID is just a mail DL with same domain which uses its own set password during Atlassian Sign-up and is not a user present in Azure AD. 

For this we need to disable/Deactivate the SAML SSO configuration at Atlassian end so that the SAML it doesnt redirects to IDP url.

2.Also , post clicking the JIRA APP from app panel its redirecting to Atlassian login page everytime and looking for only email with same domain. Want to stop getting this page so any configuration required?

SSO is working fine as SAML response is posted to ACS url successfully.

Regards,
Satish Singh

[Ed Letifov [TechTime - New Zealand] · Accepted solution]

1) There is no way to exclude one account from SSO. Would it hurt to create a real user in Azure AD for admin purposes?

Also a normal security practice would require every admin account to be individual (to hold real people to account if they do something bad not some vague "admin team").

2) Can you rephrase/elaborate on the 2nd issue – it's not clear what the problem is. Who are you logged in as when this happens?

[Satish Shekhar Singh]

Hi Ed,

Can the SAML SSO configuration be deleted at Atlassian end for my organization.

Post which it will not redirect to IDP login page and we will change the Admin username/Email or anything with different domain and then will integrate SSO again so that issue will not occur and Admin login to Atlassian directly will work as well as SSO too.

2nd Issue is all different , After login in to myapps and then clicking on JIRA application icon , its redirecting to JIRA login page asking for username to check from which domain its coming. When we enter any verified domain username then it allows user to log in and when we enter any different domain its not allowing, We don't want this login page verifying the domain from which user is trying to login.

NOTE:We have selected grant access to user form verified domain only.