How to set JIT provisioning in the JIRA service desk

Question

Hi, we met a problem in JIT setting with Azure AD, the attributes we set in the JIT provisioning could not be found. Following are the log we are seeing when we try to login with JIT enabled, it reports attribute could not found, we also tried the full url like ${"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"} but doesn't work. We are wondering which attribute name we should use for the setting, could you provide any advice on this? Recipient="https://xxxx/plugins/servlet/samlconsumer"/>https://xxxxxxxxxxxxxxhttps://sts.windows.net/xxxx/http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/passwordhttp://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/x509http://schemas.microsoft.com/claims/multipleauthnxxxxxxxxxxxx@xxxx.comxxxxurn:oasis:names:tc:SAML:2.0:ac:classes:Password 2024-04-12 07:38:25,258+0000 http-nio-8080-exec-20 DEBUG anonymous 458x5992x1 1bayh07 10.217.201.80 /plugins/servlet/samlconsumer [c.o.saml2.authn.SamlResponse] SAMLResponse has NameID --> xxxx@xxxx.com 2024-04-12 07:38:25,259+0000 http-nio-8080-exec-20 DEBUG anonymous 458x5992x1 1bayh07 10.217.201.80 /plugins/servlet/samlconsumer [c.o.saml2.authn.SamlResponse] SAMLResponse has NameID Format --> urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress 2024-04-12 07:38:25,259+0000 http-nio-8080-exec-20 DEBUG anonymous 458x5992x1 1bayh07 10.217.201.80 /plugins/servlet/samlconsumer [c.o.saml2.authn.SamlResponse] SAMLResponse has attributes: {http://schemas.microsoft.com/identity/claims/tenantid=[3f0bdd77-1711-49bc-9b8c-6f2ba3e1c085], http://schemas.microsoft.com/identity/claims/identityprovider=[https://sts.windows.net/3f0bdd77-1711-49bc-9b8c-6f2ba3e1c085/], http://schemas.xmlsoap.org/ws/2005/05/identity/claims/Name=[xxxx], http://schemas.microsoft.com/identity/claims/objectidentifier=[xxxx], http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname=[xxxx], http://schemas.microsoft.com/claims/authnmethodsreferences=[http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password, http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/x509, http://schemas.microsoft.com/claims/multipleauthn], http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname=[xxxx], http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress=[xxxx.com]} 2024-04-12 07:38:25,261+0000 http-nio-8080-exec-20 DEBUG anonymous 458x5992x1 1bayh07 10.217.201.80 /plugins/servlet/samlconsumer [c.onelogin.saml2.Auth] processResponse success --> XXXXXXXXX 2024-04-12 07:38:25,268+0000 http-nio-8080-exec-20 ERROR anonymous 458x5992x1 1bayh07 10.217.201.80 /plugins/servlet/samlconsumer [c.a.p.a.i.w.u.i.jit.mapping.SamlUserDataFromIdpMapper] Could not find givenname in the SAML response, it could mean that there is misconfiguration 2024-04-12 07:38:25,268+0000 http-nio-8080-exec-20 ERROR anonymous 458x5992x1 1bayh07 10.217.201.80 /plugins/servlet/samlconsumer [c.a.p.a.i.web.filter.ErrorHandlingFilter] [UUID: d9f1f911-2d3d-42be-bdb4-6b63e54643ea] Attribute [givenname] could not be found com.atlassian.plugins.authentication.impl.web.usercontext.impl.jit.JitException: Attribute [givenname] could not be found at com.atlassian.plugins.authentication.impl.web.usercontext.impl.jit.mapping.SamlUserDataFromIdpMapper.extractAttribute(SamlUserDataFromIdpMapper.java:42)

Ivan Lima · Answer

Welcome to the Atlassian Community.

I would start comparing the attribute mappings in your Atlassian application to ensure they match exactly with the attribute names sent from Azure AD, including the namespace URI, and that the "givenname" attribute is correctly configured to be sent. The following KB can help you to review the parameters.

* https://confluence.atlassian.com/jirakb/suggested-claim-mapping-between-azure-ad-and-jira-1384121692.html