nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Provisioning groups from custom IdP

Jeffrey Anderson

We use Atlassian Access with a custom IdP proxy running simplesamlphp, which proxies through to a federated login.

Since this is an IdP proxy, I don't think we can just sync the users and groups over, as a valid user has to authenticate against a federation.

But we do provide group information in the SAML assertions sent by our IdP.

What do I have to do to integrate that group information with Confluence? We provide a list of groups under the 'groups' attribute. Is it sufficient to match the names of these groups with Atlassian groups? Or do I need to modify the group attribute name in some way?

Accepted answers

All comments

Dave Meyer

Hi @Jeffrey Anderson ,

You can use our SCIM API to send group information and updates and have them synced to Atlassian (and groups will be synced to your Confluence site assuming it's linked to your organization with Atlassian Access).

Check out:

https://confluence.atlassian.com/cloud/user-provisioning-959305316.html

https://developer.atlassian.com/cloud/admin/user-provisioning/rest/intro/

Jeffrey Anderson_g1t66a

Thanks, this is useful.

I have a question though. I've managed to create some groups via the SCIM API. We also have managed users, but those users were created through JIT provisioning and don't show up when I query the directory via the API. It seems that they do not have a "value" attribute, which is necessary to add them to managed groups.

I'm wondering what I can do safely. The accounts exist and can be used, but are not marked as "synced" users. That much is ok, but is it possible to use SCIM to make those users members of managed groups?

I guess this is some sort of hybrid use of the managed directory that was not intended. It seems that you expect the users to be provisioned in one step from the IdP, which is not how we have done it.

Jeff

Jeffrey Anderson_g1t66a

I intended this as a question to Dave's answer, not as an answer to my original question.

Dave Meyer

Hey @Jeffrey Anderson ,

If you sync a group via the SCIM API with a user that has the same email address as an existing managed account, the profile details from the SCIM push will overwrite the existing profile attributes of the account, and the account will be treated as managed externally and they will have membership in whichever external groups you've synced.

I think this is what you want and it's a fairly common scenario. Most customers have a number of existing accounts (either created directly with Atlassian and then having SAML SSO enabled later, or created with JIT provisioning with SAML). Hopefully this makes sense.

Jeffrey Anderson_g1t66a

OK, I think that is what we want.

If you could just clarify one thing --

at https://developer.atlassian.com/cloud/admin/user-provisioning/rest/api-group-groups/#api-scim-directory-directoryid-groups-id-patch

there is an example of updating group membership. It seems that users have attributes "display" and "value" where value is some UUID sort of thing. How do I find out the "value" for my existing users?