SAML SSO Integration in Confluence Data Center

Falk Sporbert NANGA SYSTEMS

They’re implementing SAML SSO for Confluence Data Center and have a problem with username mapping.
They want to use sAMAccountName as the username (because that’s their standard LDAP ID), but Azure AD only sends the email address as NameID in the SAML assertion.
If they map the username to ${sAMAccountName}, login fails, because Confluence only receives the email and can’t find the user.
They tested a workaround by changing the LDAP username attribute in Confluence from sAMAccountName to mail and using ${NameID} in SAML, which works but is not acceptable long term, since all other systems use sAMAccountName.
They’re asking whether you have experience with this setup and how to correctly configure the attribute mapping in Azure AD so that Confluence can use sAMAccountName.

Winderson Souza

Hi Falk, welcome to the community.

I think the best option is for them to open a Support ticket. But there are three options.

If they use ADF integration to synchronize the users, they can change the mappings in the synchronization.

If not, they can change the user mapping in the AD SAML to change what is sent in the attribute.
https://learn.microsoft.com/en-us/entra/identity-platform/saml-claims-customization#table-3-valid-id-values-per-source

Or they can remove the email from Confluence directory, a bit of hard work, but could be done with regex if the users are in the internal directory.