nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

SOLVED: Crowd/Jira/Confluence integration with Azure AD for SSO (design & fail)

Peter Meuser

I am exploring ways to integrate Jira, Confluence etc. with SSO to AzureAD. My idea so far is to use the direct directory integration of Crowd with Azure AD to provision users and groups. SSO auth with Atlassian tools should happen with snap-ins like "Microsoft Azure Active Directory single sign-on for JIRA".

This article seems to point in the same direction:

https://community.atlassian.com/t5/Crowd-questions/Authenticate-Azure-AD-users-against-Crowd-and-Atlassian-products/qaq-p/849794

Has anybody get such an setup already up and running?

So far I fail already in my test setup with the following error message when trying to sync Crowd with AAD:

2019-02-19 09:31:45,005 Caesium-2-4 INFO [microsoft.aad.adal4j.AuthenticationAuthority] [Correlation ID: b28eb4bb-e5f4-4433-bb59-c4881b655d50] Instance discovery was successful
2019-02-19 09:31:46,520 Caesium-2-4 ERROR [atlassian.crowd.directory.DbCachingDirectoryPoller] Error occurred while refreshing the cache for directory [ 1277954 ].

Thanks a lot for your input!

Peter

Accepted answers

Peter Meuser

Crowd sync error with AAD solved:

https://community.atlassian.com/t5/Crowd-questions/Invalid-Login-Error-and-no-sync-with-Azure-Active-Directory/qaq-p/809117

Peter Meuser

If anybody is interested: Works as expected! You can use all "bells and whistles" of Azure AD authentication as:

Azure MFA (and other conditional access related protection)
Password-free authentication with Authenticator app
(USB) Token key MFA with third-party products like Duo security
Support for external IDs (B2B guests)

Very cool stuff.

Would be nice to see Atlassian having an official documentation on that.

All comments

Peter Meuser

Crowd sync error with AAD solved:

https://community.atlassian.com/t5/Crowd-questions/Invalid-Login-Error-and-no-sync-with-Azure-Active-Directory/qaq-p/809117

Peter Meuser

If anybody is interested: Works as expected! You can use all "bells and whistles" of Azure AD authentication as:

Azure MFA (and other conditional access related protection)
Password-free authentication with Authenticator app
(USB) Token key MFA with third-party products like Duo security
Support for external IDs (B2B guests)

Very cool stuff.

Would be nice to see Atlassian having an official documentation on that.

Joost van Orsouw

Hi Peter,

Maybe you can help us out;

We had an internal Atlassian environment for which we used a SAML SSO plugin to authenticate against Azure, wich is working fine
The user directory was directly retrieved from our internal AD
We are now migrating to a hosted environment which will not have access to our internal AD
By installing Crowd, we managed to setup the User directory against Azure AD, and we can now see the users in our tooling (tested with Jira & Confluence)
We would like to replace the SAML SSO plugins by the Crowd SSO plugin, in which Crowd would authenticate against Azure, just like in your setup.
Now we are however totally stuck within the documentation on how to move on from here.

Can you give us some pointers and/or share details of your setup? It would be much appreciated!

Kind regards,

Joost

Peter Meuser

Joost, I am using on-prem Crowd to sync accounts from Azure AD to Jira/Confluence. For Jira/Confluence auth happens with Microsoft‘s SSO plug-ins for AAD. I know, that the cloud version of Crowd supports SAML, but have never tried to use this for SSO.

Peter

Joost van Orsouw

Ok, thanks for your reply. We were hoping that Crowd would be able to replace any additional SSO plugins, but it seems to be only in addition then. The MS plugins are not available for Bitbucket & Bamboo as far as I know. That would then mean that users need to use Jira or Confluence before going to Bitbucket or Bamboo to have a full SSO experience. We will do some testing with this setup, and I'll let you know how it went.

kind regards,

Joost

Tony Liu_wxmobb

Hi Peter,

On your Feb 19 post, you said:

>>>If anybody is interested: Works as expected! You can use all "bells and whistles" of Azure AD authentication as:

Azure MFA (and other conditional access related protection)
Password-free authentication with Authenticator app
(USB) Token key MFA with third-party products like Duo security
Support for external IDs (B2B guests)

Very cool stuff.

Would be nice to see Atlassian having an official documentation on that.

>>>

Are you integrating Crowd with Azure AD? We are about to integrate Atlassian with AAD, but if following the instructions on this doc: https://confluence.atlassian.com/crowd/configuring-azure-active-directory-935372375.html

It says "Crowd doesn't support multi-factor authentication.You'll need to disable it for your users in Azure AD, or they will not be able to log in to Crowd or any integrated applications. ".

Would you care to share more details what you did?

Thanks

Tony Liu

Peter Meuser

Tony, the trick is, that you don't use Crowd for SSO. The approach that I have followed is to install SSO plug-ins for AAD from Microsoft on Jira and Confluence. These support of course all AAD supported sign-in methods incl. conditional access and MFA. Crowd is just used as central user directory for Jira and Confluence. You can sync users between Crowd and AAD and then from Crowd to Jira/Confluence. This is how it works for me in a PoC for a larger environment.

Tony Liu_wxmobb

Peter, Thank you and thank you for the quick response.

Regards,

Tony

Christian Reichert (resolution)

Hi Peter,

the Alternative to this can be one of the commercial Plugins like ours. For example with our Plugin you can synchronise Users straight into Confluence / Jira and also do all the authentication via SAML.

So depending on our exact setup you could get some of these benefits:

No need for Crowd (Licensing + Server + Operational costs)
As SSO is the only Way for Users to login, most of our customers see this as business critical and hence want a Solution that has official & commercial support.
As a Top vendor we have to deliver compatible versions to the newest Atlassian products within 14 days of release (usually it's within hours, as we get access to Beta releases).
Our plugin supports a variety of additional features, that very often are reuqired in enterprise deployments (multiple IdPs, single logout, encryption, group/user filtering & transformations just to name a few).
Our Plugins are available for all Atlassian Products not just Jira/Confluence.

In short there are multiple Ways to get to a working solution - you need to judge depending on your use case, which one suits you better.

Here are our plugins on the marketplace: https://marketplace.atlassian.com/vendors/1210947/resolution-reichert-network-solutions-gmbh

We are not the only choice, there are more: https://marketplace.atlassian.com/search?query=saml

Here is the Setup for Azure AD described: https://wiki.resolution.de/doc/saml-sso/latest/all/setup-guides-for-saml-sso/azure-ad/azure-ad-with-user-sync

Cheers,
Chris

Joost van Orsouw

Regarding our final setup;

We completed the setup by using SLDAP in Azure
Using SLDAP takes away the need for crowd
After the user directory for SLDAP was created, we did a sync which worked fine
When setting up the directory we also set a default group (eg Jira-Users) for users that have successfully authenticated
SLDAP was beneficial to us, since we could setup the user directory exactly the same as we did when the environment was still internally hosted and connected to AD
@Christian Reichert (resolution) ; we tried the Azure Sync of your plugin together with your support team, but the sync was very slow and we had issues with the username (we use firstname.lastname instead of e-mail). Because of the different format user search produced duplicate results, and tickets were not connected to the new user format. Since it was a new feature, we decided to wait until it has developed further
After the user directory is in place, you can use a paid plugin, or the free one from MS to setup a SAML connection with Azure
We have setup conditional access with MFA and everything
@Tony Liu ; above setup works perfectly for us. If needed I think I can share to setup documentation after anonymizing it

Kind regards,

Joost

Peter Meuser

Joost, if you do not rely on Crowd on-prem, this is a valid approach, too.

"SLDAP for Azure" means, you have enabled the additional product "Azure AD Domain Services", right?

It would be nice to see, that Atlassian supports Azure AD beside AD in all their products, so that Crowd, AAD-DS, third-party tools which all add complexity are not required anymore.

Tony Liu_wxmobb

@Joost van Orsouw , Thank you so much for sharing your experience. Yes, it'd be greatly appreciated and helpful if you could send your setup doc. What's the best way I send my email address to you?

Joost van Orsouw

Give me some time tomorrow, and I'll create a short setup guide for it. Maybe we can post it here, otherwise I will share a link

kind regards

Joost

Oleksandr Zharnovskyi

@Joost van Orsouw could you please share a brief setup doc?
thank you!

KO89

@Peter Meuser

Hello, I was able to set up SSO using the free plugins as well. However, you made a point that plugins have "Support for external IDs (B2B guests)". Can you verify this to be true? Currently, my internal users work fine but my B2B users sync to crowd with a #EXT#dosinvest.onmicrosoft.com added to the end of the userprincipalname.. this makes it impossible to use the plugin. Do you have any experience with this?

Thank you

Stephen Neil

Hi Peter, did you manage to address this? We may be observing a similar issue with external users and the plugin

(It is working for external Gmail users with a MS live account, but failing for other users with their own external AzureAD accounts - those accounts can successfully access other resources on our Office365 area, e.g. SharePoint, so we know their external SSO accounts are working...just not through JIRA)

Peter Meuser

Please have a look at the recently introduced value "user.localuserprincipalname" for an additional claim in SSO section of your AAD enterprise app setting.

Peter Meuser

Please have a look at the recently introduced value "user.localuserprincipalname" for an additional claim in SSO section of your AAD enterprise app setting.

Stephen Neil

Much appreciated for the pointer there @Peter Meuser - claim added and awaiting feedback

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

jira

crowd

sso

azure

active-directory

microsoft