nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Portal-only Customers identify provider - not seeing option for provisioning

Christian Lipski

I've set up SSO with Okta for my portal-only JSM customers using this guide, and that is working.

My next goal is to provision Customers from Okta, but when I follow these steps, I get stuck on step 6 "Select Set up provisioning and follow the on-screen instructions" because there is no such option, either on the Identity Providers page (where it appears under the three dots for regular user setup in Admin), or in the specific directory I created for the Customers.

Has anyone else set up SCIM provisioning for JSM Customers? Did you need to do the SSO and provisioning at the same time (i.e., it's only available during directory creation, and you can't go back and edit)?

Accepted answers

Marc -Devoteam-

Hi @Christian Lipski

You might need to look how Okta handles this, if this is Okta related.

https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard.htm

All comments

Gabriela - LeanZero

That option only shows for an Organization admin with Atlassian Guard, and your role is almost certainly the block. Provisioning for portal-only customers is set up at admin.atlassian.com, and Atlassian documents the required role as Organization admin, so a Product admin won't see "Set up provisioning" at all. SSO already working doesn't rule this out, since that can be configured by someone else or was already in place.

The other requirement is Atlassian Guard Standard. Customer SSO and SCIM provisioning both depend on it, and the provisioning option appears once Guard Standard is subscribed. Confirm it's active on the org, not just that SSO happens to work.

On the timing you asked about: provisioning doesn't have to be enabled when the directory is first created. It's added to the identity provider connection you already have. Open the linked IdP under Security > Identity providers, and "Set up provisioning" is there once you're an Org admin with Guard.

Docs: https://support.atlassian.com/provisioning-users/docs/understand-customer-provisioning-for-jira-service-management/

Christian Lipski

Hi Gabriela, and thank you for your response.

I am an Org admin, and I'm the one who set up SSO for the JSM Customers and JSM Users.

Provisioning appears as an option for the identity provider connection for JSM Users, but not for the one for Portal-Only Customers.

Atlassian Guard is included with the JSM product I am administering.

In Security > User Security > Identity Providers, the headings are:

Directory Name
Single sign-on
Provisioning
Actions (this column has the ... which contains "View SSO configuration" and "Configure provisioning")

In Sites > (site name) > Service Collection > Portal-Only Customers > ... > Identity Providers, the headings are:

Directory Name
Identity Provider
Single sign-on

I appreciate your insight - let me know if you have any more ideas!
Christian

Marc -Devoteam-

Hi @Christian Lipski

You might need to look how Okta handles this, if this is Okta related.

https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard.htm

Christian Lipski

What makes you think it is Okta-related? Are you suggesting that something in Okta is preventing Jira from displaying the option to provision? I'm not following...

Marc -Devoteam-

You mentioned you use OKTA as SSO, I want to use this for your the customer portal as well.

The documentation you used is based on SCIM, but OTA might have precise requirements, this is also mentioned by a link to OKTA documentation in this process.

Christian Lipski

Thank you - I'm following the setup for SCIM in the existing Okta application, but there's no provisioning field on the General tab to select SCIM from.

Everything seems to be setup properly: the application was created with the AIW, and it's not an OpenID Connect (OIDC) integration, so the next step is going to have to be contacting Okta support to see why provisioning is not available for this integration.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

scim

jira-service-management-cloud

provisioning

jira-service-management

jsm-customer