User Directory AD/LDAP Switch to Email as Account Name Problem

Question

Good afternoon community,

We are implementing Azure SSO login for Jira. Part of the problem we are having however, is that our Azure does not have the samAccountName attribute, and uses the email address to authenticate. Since we cannot pass the samAccountName back, we are looking at using the email address instead of the samAccountName as the account name in Jira.

We setup a second user directory and are using the email attribute in place of the samAccountName, and when testing the LDAP, we are getting this-

Is there a way to get around the failure in this test? I am starting to think that I may not be able to do this from the Jira side, and may need to work with the Azure admin to get the samAccountName to sync out to Azure... help is appreciated!

Thanks,

Jeff

Christian Reichert (resolution) · Answer

My pleasure - great to hear.

Jeff Lapsley · Answer

Thank you. With the attribute name my Azure admin was able to pass through the samAccountName, and everything worked great. Thank you for your time!

Christian Reichert (resolution) · Answer

Hi Jeff,

if you use Directory Sync from Microsoft & only want to authenticate Users that are in your AD/LDAP - then you can use the samAccountName.

The attribute on AzureAD is called: user.onpremisessamaccountname

So in other Words Directory Sync synchronizes the AD's samAccountName into user.onpremisessamaccountname

If you configure your Enterprise Application in Azure to send you user.onpremisessamaccountname in the Name identifier value you should be fine.

Cheers,
   Christian

Full disclosure I work for resolution a Markteplace Vendor for SAML Single Sign On App