confluence 7 SAMl SSO with Azure AD

Question

Hello everyone,

I'm trying to setup SSO with SAML 2.0 on confluence DC version, with Azure AD as IdP. but I'm a bit lost at what claims are required for this and what I should use for user mapping.

any pointers?

== edit ==

I tried ${NameID}, but didn't work. got errors like below:

-- referer: https://login.microsoftonline.com/ | url: /plugins/servlet/samlconsumer  traceId: 3c6032fed8d58f2d | userName: anonymous
com.atlassian.plugins.authentication.impl.web.saml.provider.InvalidSamlResponse: Received invalid SAML response: Signature validation failed. SAML Response rejected

also double checked with our IdP admins that Azure just signed the assertion port of the response, and the ertificate is correct.

Alan Cheng · Answer

Hi Lokesh,

right, JIT user creation is NOT enabled.

I noticed that setting but thought that, with SSO, all user information should be coming from Azure AD instead of created/stored locally in Confluence DB.

And I remember I saw that option was NOT enabled on another confluence instance in the company I work for but still SSO works fine.

anyway, I'll double check and enable that option and see what happens.

Thanks again for the responses!

nice doc, by the way!

Lokesh Naktode_miniOrange · Answer

Hi Alan,

It seems the Just in Time user creation is disabled in the SSO App configuration or user identifier mapping is wrong (usually username -->with--> NameID from SAML Response).  Please map the correct attribute (which contains the confluence username in SAML Response) with the username and try again.

In case if you are using the miniOrange SSO plugin then the below docs will guide you through the mapping or you can reach out to miniOrange Support for a faster and free end-to-end setup.

https://docs.miniorange.com/documentation/saml/configure-idp/edit-idp-settings/user-profile

Alan Cheng · Answer

Hi Lokesh,

thanks for the response!

I verified thtat the certificate is correct and IdP just sign the assertion portion of the response.

also, I upgraded SAML plugin after some debugging and now I got a different error saying the user <xxx> does not exist.