Hello,
Hoping someone will be able assist with this ask. I have successfully setup SSO for our ADFS (on prem not cloud). During testing, the values are passed and saml stack tracer shows all is good. The problem is a redirect back to our /adfs/ls/ prompting the user to enter domain username and password. Upon which they are redirected to the startpage. As this "works" it is only a cache of their credentials and will be prompted again when the session token expires. This is not acceptable.
The guide followed is located here: https://confluence.atlassian.com/cloud/configure-saml-single-sign-on-with-active-directory-federation-services-ad-fs-975020616.html?_ga=2.266415374.1227830942.1594227757-1489549613.1594227757
Also, we do have an odd configuration with user UPN. As the username does match the email address. Typically this resolved by creating a claim to pass SAM as name ID and transform email to name ID.
Thank you.
If it is your /adfs/ls/ that is prompting the user, then it's a problem on your ADFS side.
If by "prompting" you mean "domain credentials popup" – ADFS is probably trying to do NTLM/Kerberos authentication of the user. Are you accessing your cloud from a domain-joined machine i.e. is NTLM/Kerberos even possible for you? If not, then this authentication mechanism needs to be disabled for external networks – this would be on ADFS side. Also check if your ADFS host is recognised as being in Intranet Zone in IE/Internet Options – transparent SSO won't be possible otherwise.
If this is a regular web form from ADFS, then what you describe is exactly how it should work. ADFS logs the user in, stores this fact in a cookie, redirects back to Service Provider (Atlassian Cloud), when the session expires it will prompt again indeed. What were you expecting?
It looks like you're new here. Sign in or register to get started.
