How to enable a mix of internal & external users?

Philip Colmer

At the moment, we're running Jira, Confluence and Service Desk as self-hosted server products. Each of them syncs to our LDAP infrastructure, which holds account information for internal and external users.

I'm trying to map all of this onto the Cloud offerings and I'm stuck with how to deal with the external users.

I've got Atlassian Access syncing against Google for the internal users, with our verified domain.

It looks like we can't use Atlassian Access to hold accounts for our external users, even if we tried to use the REST API to do so, because the documentation says:

"A user account can only be created if it has an email address on a verified domain."

and I'm not going to be able to claim verification on every domain.

In theory, I think I could work around this by creating "local" users on each of the actual Cloud products ... but then the group membership breaks because the groups are held in Atlassian Access ... and they are going to be incomplete because they can't hold external users.

What the heck can I do? I thought that I could use our Keycloak SAML server but (a) that isn't one of the supported IDPs and (b) I think we'd hit the external domain problem again.

 

Philip Colmer

It does occur to me that one potential solution would be to get all of our external users to sign up for an Atlassian ID account. I say that because I clearly only have one Atlassian ID account and that gives me access to various Jira Cloud sites that I do not manage.

However, I would then seem to have a problem in terms of looking up an external user in order to determine their ID reference so that I can add them to our groups.

The absolute fallback workaround would be to generate internal accounts for all of the external users but that is a massive failure if we reach that point because it puts a huge hurdle in the way of signing up people for access.