Assign App Access to SCIM synced groups

[spencmax]

I'm using SCIM to provision users and groups to my Identity Provider (with verified domain) in Atlassian. I'd like to grant app access to the synced groups, but I'm not seeing any way to do that. Is this possible?

Navigating to Security -> Identity Providers -> <my_idp> -> View Groups, I can see the groups I synced over for testing, but see no way to assign app access to them. Delete is the only option.

If I go to Directory -> Groups, the synced groups are not shown there, so from this view I'm only able to add app access to non-synced groups

I also thought the Apps page might allow what I'm attempting, but that doesn't work either. Only non-synced groups show in the dropdown when adding a group to an app. Using my Bitbucket app as an example and clicking `Add Groups`: 

How can I add group access to my IdP synced groups (e.g. 'another atlassian group') in the same way I'm able to add them to non-synced groups?

[spencmax · Accepted solution]

After reaching out to support, this was confirmed to be an existing, known bug. Groups created via the SCIM API will not display on the Directory -> Groups page nor the 'Add groups' dropdown for apps if all apps in the organization are "siteless."

The workarounds are:

• Add at least one sited product (E.g. Jira Software, Statuspage), or
• Contact Atlassian Support to enable SCIM for a siteless organization

In my case, I initially only had Bitbucket (siteless). I added Statuspage and then SCIM-created groups began appearing in all the expected places. 

[Kieren _SmolSoftware_]

Nice work!

[Kieren _SmolSoftware_]

Hi @spencmax 

From what I can see, it looks like you're doing all the right things. The SCIM groups should show up in your Groups list, and they should be available to add to your apps.

Can you look at the Identity Provider status page and tell us what you see? Here's an example of mine. Do the logs indicate that a successful sync has already occurred?

[spencmax]

Hi, Kieren!

Thanks for the response! A screenshot of my identity provider page is below. A couple additional details I should have mentioned prior, just in case they're relevant:

• I'm currently on a trial of Atlassian Guard
• I'm provisioning users and groups using the SCIM API directly: https://developer.atlassian.com/cloud/admin/user-provisioning/rest/intro/#about
• Because of ^that, I'm not using any "officially supported" integration like Google, Azure, or Okta. When adding the identity provider, I chose type "Other provider"

More notably, it seems like provisioning works a bit different in my setup than what's in your screenshot. Yours has text stating "Users sync every 4 hours," which implies a "pull" from Google to Atlassian, initiated by Atlassian. In my case, there is no scheduled sync, but rather my app pushes updates to Atlassian on-demand, and there is no scheduled sync time. I'm not sure if any of that makes a difference to expected behavior in the UI.

Note: the error count shown for provisioning in the IdP screenshot page can be ignored. That's expected due to me testing various scenarios with my application's API calls.

[spencmax]

I should add, regarding my statement:

Yours has text stating "Users sync every 4 hours," which implies a "pull" from Google to Atlassian, initiated by Atlassian.

this is just a guess on my part. Looking at Google's documentation for the integration, it does seem they push updates to Atlassian on-demand as well.

https://support.google.com/a/answer/9288575?hl=en

[Kieren _SmolSoftware_]

I've never tried it using the SCIM APIs sorry.

Do you have the logs from the APIs? I assume they were successful?

[spencmax]

Correct, the group provisioning was successful. From the audit logs:

[spencmax]

Inspecting network traffic when viewing each page, I can see that the Directory -> Groups page calls this to fetch the groups to display:

/gateway/api/adminhub/um/org/<org_id>/groups?count=20&start-index=1

While the Security -> Identity Provider -> my_idp -> View Groups page instead calls:

/gateway/api/adminhub/external-directory/manage-directory/<idp_id>/synced-group-memberships?startIndex=1&count=20

I know that doesn't really mean much on its own, but given the groups seem to come from different API handlers for the Atlassian admin UI, it makes me wonder if groups created via SCIM API are not expected to be visible in the rest of the admin portal and cannot be used to assign app access. 

[Kieren _SmolSoftware_]

The Group page and the IDP management pages were built by completely different teams, on different databases, so it's reasonable that they have different API calls.

Given the audit logs show the group was created, and you're unable to see the group in your Group List, I'd suggest contacting Atlassian support for more help. Sorry the community couldn't solve this one, but report back if you get an answer!

[spencmax]

Confirmed to be a bug! Additional details in the answer I added. Thank you again for your help and for the suggestion to contact support.