User Provisioning with OneLogin

[Mate Major]

Hi all,

I am trying to do the automated user provisioning from OneLogin to Atlassian Access and doing so with the help of this guide:

https://onelogin.service-now.com/support?id=kb_article&sys_id=05501489db792708ca1c400e0b9619ea

Everything seems to work fine and it says the user has been provisioned in the onelogin backend, however i cant pull my groups from Atlassian Acces as it shows on the picture below. I have a blank box instead. I have been through this guide about 20 times followed the steps properly. Anybody has any idea what else can be done?

Thanks in advance

I have reached out to Onelogin and they have sent me this:

"Mate,

There is nothing wrong with the onelogin side. The issue is we are asking for the values from here 

https://api.atlassian.com/scim/directory/7f373c24-ab7a-4223-b2af-f2d996237663/Groups?count=100&startIndex=1 

We are getting a good response 200 Ok 

[INFO Fri Mar 01 13:32:38 +0000 2019] Response Code: 200

Yet Atlassian API is reporting back 0 results 

"{"startIndex"=>1, "totalResults"=>0, "itemsPerPage"=>100, "Resources"=>[], "schemas"=>["urn:ietf:params:scim:api:messages:2.0:ListResponse"]}"

I do not have any information other than this response showing 0 results I would recommend reaching out to TS at atlassian and find out why this call at https://api.atlassian.com/scim/directory/7f373c24-ab7a-4223-b2af-f2d996237663/Groups?count=100&startIndex=1 using your GUID 7f373c24-ab7a-4223-b2af-f2d996237663 and token is responding with 0 results. 

Best Regards"

Anybody has any ideas?

Thanks in advance

[Demi Benson · Accepted solution]

Hey Máté,

I had troubleshooting sessions with both Atlassian and OneLogin, and in my case, the reason the groups weren't showing up is because I had to setup new rules (the "Rules" tab in the Atlassian Cloud app), and the rules have to do regex capture on a user's OneLogin metadata (User Info -> Directory Details -> MemberOf box) to populate the groups.

I wish that information was more clear in both sides' documentation.

[Mate Major]

Thanks Demi,

I got tired of waiting and added the users manually. Nobody answered me for a long time so this was easier. Thanks for reaching out though.

Best

Mate

[Mate Major · Accepted solution]

Hi Jonathon,

Thanks for the answer. I have tried to do this and it still doesn't show any groups for me in OneLogin at all. Could you please send me a step by step or point me where you have updated the documentation so i can make this work?

Thanks a lot

Best Regards

Mate Major

[Jonathon Yu]

Hi Máté,

If you're setting up SCIM automatic user provisioning for the first time, your Org in Atlassian Access won't have any groups associated with it, so when OneLogin or you query the API you'll get zero groups returned. You might have groups that already exist in your Jira site, but those are in a tenant/site context and not global, so those aren't the same groups that OneLogin would pull.

To set up groups in automatic user provisioning, in your OneLogin dashboard you would go to the "Roles" tab in the "Users" dropdown. Creating these Roles corresponds to a SCIM group; you could then assign users to these roles and push the group in the parameters tab for your app as seen in OneLogin's documentation.

We'll follow up with OneLogin to clarify and update the documentation, hope this helps!

--Jonathon | Access Engineering

[Demi Benson]

I'm having the same problem as the OP (no groups in Atlassian Access user provisioning, and no groups means new employees don't have access to anything), and my OneLogin config is set to give Atlassian site access via a OneLogin Role (called "Everyone", since it's for everyone in the company); that part works.

But when I edit the Atlassian Cloud app in OneLogin, and edit the Groups optional parameter, there are no roles or groups in the picker, and therefore none can be sent over.

Can you give us an update on how we should be adding new people? Because the whole purpose of going with Atlassian Access is to provide consolidated user management. If new employees can't get access, then what's the point?