JIT Provisioning with Keycloak SAML to servicedesk URL redirects first-time users to Login Page

Question

Environment * Identity Provider: Keycloak (SAML 2.0) * Atlassian product: Jira Service Management (JSM) * Domain verification: Enabled (verified domain) * Provisioning method: JIT (Just-in-Time) via SAML What I'm trying to achieve I want first-time users to be automatically provisioned via JIT and land directly on a specific JSM Help Center/portal page after authentication. The goal is a seamless SSO experience where: * User clicks a link (e.g., a ticket portal URL) * Gets redirected to Keycloak for authentication * JIT provisioning creates/grants their account access to JSM automatically * User lands on the intended servicedesk page The Problem I'm passing the servicedesk portal URL (e.g., /servicedesk/customer/portal/X) in the SAML RelayState parameter. Observed behavior for first-time users: * When RelayState = servicedesk/portal URL → User is redirected to the Help Center login page instead of being logged in and taken to the portal * When RelayState = /jira (or any non-servicedesk URL) → User is shown a screen saying they "need to request access" — which is also not the desired behavior, but at least they're authenticated and can request access from there. In both cases, returning/already-provisioned users land on the correct page without any issues. The problem is isolated to first-time JIT-provisioned users. What I've tried * Passing different variations of the servicedesk URL in RelayState * Ensuring the SAML assertion includes the correct attributes for JSM product access * Confirming that JIT provisioning itself works (users do get created in Atlassian) Questions * Is there a known issue or limitation with RelayState and the JSM Help Center for JIT-provisioned users on their first login? * Is there a specific URL format or path that should be used in RelayState to correctly redirect first-time users to the servicedesk portal post-provisioning? * Is there any recommended workaround — such as a landing page, a specific Atlassian URL that handles post-provisioning redirects, or a JSM-specific SSO entry point? Any guidance from the community or Atlassian staff would be greatly appreciated!

Anish Sapkota · Answer

I have almost similar situation where I am trying to setup IDP-initiated SSO for portal-only customers. In my case, I already have user added as a customer on the jira portal. I tried settting RelayState parameter as "https:///servicedesk/customer/portals". It was mentioned in https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-for-portal-only-customers/#Available-SAML-attributes. But the after the authentication, there is some redirection loop and it redirects back to base url. But after that if user goes to the support portal in same session: "https:///helpcenter/", user is logged in there. I also tried setting RelayState parameter as: "https:///helpcenter/" but it also had same issue.

Marc -Devoteam- · Answer

Hi @Vaibhav Verma

But this doesn't answer my question.

Is the user already created in Atlassian before the user gets to the portal?

Is the created user listed as a customer on the project before the user gets redirected to the portal?

Vaibhav Verma_3gdjlv · Answer

No the user is getting created in Atlassian at the time of SAML login to Atlassian from keycloak. I want at that time when user is getting created should also get JSM permission and user should be able to see help center screen.