nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Problem with SSO / SAML Setup with Azure AD

Minh Tran_tpa8p3

After completing all the documented steps and deleting and retrying the app configuration in Azure a few times, we still get this error when trying to configure SSO:

Browser error we get after clicking login and getting redirected from the login window:

This sts.windows.net page can't be foundNo webpage was found for the web address: https://sts.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxx?SAMLRequest=buaZHXoirzCQAsIdFm3ZLveZOnjKkuE1UOvZRlNWM1Ex0rKtlkkE8yxFFtLAawoSV5mjOaVjRt9lnFWclZExfl7BuJtpeEPkxOzslfi1O8iJB%2F3O%2B3dPtltyfR19cGJwG59MXPdP%2B%2BqOuL4bUdsrjSxWlR8j%2BJz5P3Nt6O6PPE3ay3zmj5O1oZ4443XkFQLQl%2BVCS6dX6A8G%2BnWZydX3RH%2B7OUqwG0WXWdV4gkWVy4f5%2Fr4g8%3D&RelayState=4b117eed-5515-4880-9131-32c2f36b7a91
HTTP ERROR 404

Any insights into the connection error?

Accepted answers

All comments

Lokesh Naktode_miniOrange

Hi @Minh Tran

It appears there may be a configuration issue, likely related to the ACS URL configuration.

To resolve this, you'll need to collect the SAML metadata from both the Atlassian Access and Azure AD and configure them accordingly.

For detailed guidance on the setup, you can refer to the following document:

https://support.atlassian.com/provisioning-users/docs/connect-to-azure-active-directory/

https://learn.microsoft.com/en-us/entra/identity/saas-apps/atlassian-cloud-tutorial

As an SSO vendor, we have created an extensive setup guide for configuring SAML SSO with Azure AD for our Data Center app. You can refer to its Azure AD configuration as well.

https://www.miniorange.com/atlassian/saml-single-sign-on-sso-jira-using-azure-ad-idp?version=2.0.0

Minh Tran_tpa8p3

Thanks for your reply - This is for Atlassian Cloud and we have followed the instructions in both those links you provided (although we are not setting up provisioning just yet, just SSO). We've repeated the steps multiple times and deleted the app and restarted without success. After double and triple checking that we copied the contents to and from Azure AD and Atlassian SAML set up correctly, we continue to run into the 404 error.

Hector Menchaca

Hello @Minh Tran ,

Welcome to Atlassian Community!

In order to solve this issue you just need to swap the values Identity Provider Entity ID and Identity Provider SSO URL in your SAML configuration.

Regards,

Thanks!

Minh Tran_tpa8p3

Clearly I am a novice at this. Thanks for the assist @Hector Menchaca . Just raced through the instructions and did not follow them closely enough. Assumed the order they provided was the order to enter them in the SAML set up.

jessica_huebner

I am running into the exact same error. When I switched these as you suggest, I run into a new error: AADSTS900023: Specified tenant identifier 'REDACTED' is neither a valid DNS name, nor a valid external domain.

If you have any quick tips, I'd love to know!

Hector Menchaca

Hello @jessica_huebner ,

Thanks for your reply.!

Can you let me know what is the flow you are following in order to get this error? When you switched the values on your SAML configuration and you trying to login you are getting this error?

Thanks!

jessica_huebner

Below are the steps I followed:

My Entra Admin used Atlassian Cloud app.
My Entra admin also changed the Entra Attributes & Claims so that Unique User Identifier is user.mail (our users' email addresses)
In Atlassian Admin Center SAML config, we copied the values from service provider entity URL and Service provider assertion consumer service URL and set them in Entra as the default values in respective areas and saved
From Entra, I copied the Login URL and Microsoft Entra Identifier and pasted them into Atlassian SAML config. I tried the following first (values on the left are Entra ID, values on the right are Atlassian Admin SAML Config page):
1. Login URL > Identity Provider SSO URL
2. Microsoft Entra Identifier > Identity provider Entity ID

Doing this gave me the same error as what Minh posted above (exception of course is our unique ID). Then, when I tried switching the values as you suggested, so that the Microsoft Entra Identifier was in the SSO URL field and Login URL was in the Entity ID field in the SAML config. The user got a different error: AADSTS900023: Specified tenant identifier...