nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How does Jira Data Center 11.3.7 identify and match users during SSO with Azure AD?

Vinod M_hnwjhb

Hi everyone,

I am configuring SSO between Microsoft Azure AD and Jira Data Center 11.3.7 using SAML.

I would like to understand how Jira identifies and matches the user attributes received from Azure AD during SSO. Specifically, when Azure AD sends user attributes such as username, user ID, and email address, which Jira user attribute does Jira use to compare and match the incoming SAML user with an existing Jira user?

Is the matching performed based on the Jira username, user ID, email address, or another attribute?

Also, is there any configuration in Jira Data Center that allows us to define which Azure AD SAML attribute should be used for user matching?

Any guidance or documentation on this would be greatly appreciated.

same thing in confluence also,

Thanks,

Accepted answers

Gor Greyan_wzwybp

Hi @Vinod M

Welcome to the Atlassian Community!

Jira will try to identify an existing local user based on the configured Username mapping in the SAML authentication method.

By default, this is commonly - ${NameID}

Jira evaluates that value from the SAML assertion and matches the resulting value against the existing Jira username. It doesn't automatically choose the email address or Entra ID object ID for matching.

You can check this under:

Administration → System → Authentication methods → SAML configuration → Username mapping

For example, if the existing Jira username is vinod.m

then the SAML username mapping must ultimately resolve to vinod.m. If Entra ID sends vinod@company.com as the mapped value instead, Jira won't match it to vinod.m.

You can also configure Jira to use a SAML assertion attribute instead of NameID if another Entra ID attribute contains the value matching your Jira usernames.

Atlassian documentations

https://confluence.atlassian.com/enterprise/saml-single-sign-on-for-atlassian-data-center-applications-857050705.html

https://confluence.atlassian.com/enterprise/howto-using-a-saml-assertion-attribute-as-the-product-username-945522510.html

All comments

Tomislav Tobijas

Hey @Vinod M ,

Can you just share how your users are provisioned? Are you using using Crowd or some third party app?

Also, are you using local AD or cloud Entra ID?

Cheers, Tobi

Vinod M_hnwjhb

Hi @Tomislav Tobijas

We are using the Jira Data Center internal user directory for user provisioning and management. We are not using Crowd or any third-party user provisioning application.

For authentication, we are using Microsoft Entra ID (Azure AD) in the cloud as the SAML Identity Provider. The users are maintained locally in Jira, while Entra ID is used only for SSO authentication. JIT provisioning is currently disabled.

when Azure AD sends the SAML user attributes to Jira and Confluence Data Center, which local user attribute does the application use to identify and match the user — the local username, user ID, email address, or another?

Marc Koppelaar

Hi @Vinod M

In DC , this is based on internal Username field by default.

See this article from documentation; saml-sso-for-jira-data-center-applications

Gor Greyan_wzwybp

Hi @Vinod M

Welcome to the Atlassian Community!

Jira will try to identify an existing local user based on the configured Username mapping in the SAML authentication method.

By default, this is commonly - ${NameID}

You can check this under:

Administration → System → Authentication methods → SAML configuration → Username mapping

For example, if the existing Jira username is vinod.m

then the SAML username mapping must ultimately resolve to vinod.m. If Entra ID sends vinod@company.com as the mapped value instead, Jira won't match it to vinod.m.

You can also configure Jira to use a SAML assertion attribute instead of NameID if another Entra ID attribute contains the value matching your Jira usernames.

Atlassian documentations

https://confluence.atlassian.com/enterprise/saml-single-sign-on-for-atlassian-data-center-applications-857050705.html

https://confluence.atlassian.com/enterprise/howto-using-a-saml-assertion-attribute-as-the-product-username-945522510.html

Vinod M_hnwjhb

Hi @Gor Greyan
Thanks for the clarification.

I have one more question regarding the Username mapping. When Jira matches the SAML attribute value with the existing Jira user, does it compare against the user's Username field only, or can it also compare against the user's Full Name/Display Name?

For example, if a Jira user has:

User: vinod
Full Name: Vinod Raj
Email: vinod@company.com

Gor Greyan_wzwybp

Hi @Vinod M

Yes, for the SAML login, Jira matches the value produced by the configured Username mapping against the user's Username, not their Full Name/Display Name.

Using your example, it will be.

Username:
Full Name: Vinod Rai
Email: vinod@company.com

If your SAML Username mapping resolves to.

vinod

Jira can match that to the existing user.

If it resolves to Vinod Rai, Jira will not match that value against the Full Name/Display Name as a fallback. The Display Name is not used as the account identifier for SAML authentication.

The same applies to the email address: Jira won't automatically try the email field if the configured Username mapping doesn't match the Jira username. If you want an Entra ID attribute such as email/UPN to be used for the mapping, its resulting value still needs to correspond to the username Jira expects for that existing user.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

jira-cloud

jira-data-center

sso

azure

saml

azure-ad