We're migrating to JIRA cloud but need to integrate with LDAP. How can we do this?

[W Calderon]

We have JIRA in our network on a server but we want to migrate to cloud.  User authentication is over Active Directory (LDAP works too) but the AD servers are behind a firewall.  How can we get this to work?

[Ed Letifov _TechTime - New Zealand_]

You will need Atlassian Access with your Cloud (any organisation not completely ignorant to security concerns will need it anyway, as it is the only way to enforce enterprise password policies, 2FA and in general – manage users in Cloud properly).

Atlassian Access will happily connect to ADFS with SAML, thus giving you your authentication against on-premise AD.

Also see here: https://jira.atlassian.com/browse/ID-79

[Nic Brough -Adaptavist-]

You would need to open up the firewall to allow traffic between Cloud and your LDAP server, and you'll need to subscribe to "Atlassian Access" which will connect to LDAP and provide your user accounts to Jira.

[W Calderon]

And it that is not an option?  Isn't there a SAML plugin that would work? 

[Nic Brough -Adaptavist-]

Atlassian access is the only way to connect Cloud to an LDAP system.

[Ed Letifov _TechTime - New Zealand_]

@Nic Brough -Adaptavist- where does information about Atlassian Access supporting LDAP integration come from?

From everything available publicly it will only integrate with a "cloud identity provider" i.e. via SAML at the front-end and via SCIM at the back-end, but not with LDAP directly. The Cloud Identity Provider e.g. OKTA, Azure, OneLogin may indeed work with LDAP.

[Nic Brough -Adaptavist-]

https://www.atlassian.com/software/access/guide/overview#about-atlassian-access seems to cover that.

[Ed Letifov _TechTime - New Zealand_]

I don't think it does. It's the "Cloud Identity Provider" that integrates with LDAP (e.g. OKTA via "connector" running behind the firewall), not Atlassian Access.

[Nic Brough -Adaptavist-]

But it states that if you want LDAP to connect to Atlassian cloud, you have to get Access,.  Which is correct (for now)

[Ed Letifov _TechTime - New Zealand_]

Where? Honestly, I am not picking on your answer – I genuinely need to know if this is suddenly possible...

Yes, one will need Access to connect (via SAML) to the Cloud Identity Provider that *may* be able to connect to your LDAP and also *may* be able to perform sync (via SCIM) of users from LDAP to Access... but that's ignoring a very very huge elephant (the IdP) in the room... while continuing to focus on the elephant's chain?

[Nic Brough -Adaptavist-]

Need to know if what is suddenly possible?

If you want to use your own IDP with Cloud, you have to use Atlassian Access.  There's not much more we can tell you.

[Ed Letifov _TechTime - New Zealand_]

I believe the question was how to connect to LDAP/AD. Atlassian Access does not connect to LDAP/AD directly. Atlassian Access will only connect to an IdP. If you don't have an IdP – you are out of luck. If your IdP doesn't sync with your on-premise LDAP/AD – you are out of luck. If your IdP does sync, but doesn't support SCIM protocol to push changes to Atlassian Access – you are again out of luck as far as user de-provisioning go.