Configure Okta to customize SAML SSO attributes for Atlassian Cloud

[#1]

Problem description

The Default Atlassian Cloud OIN application available on Okta doesn’t provide admins a way to customize the attributes sent on SAML SSO authentications, the only customization available is for SCIM user provisioning.

This becomes a problem when customized attributes are used on givenName and surName. Some users go through name changes, and Okta is stuck to their legal name on SAML SSO.

Due to our precedence for SAML SSO over SCIM user provisioning, every time the user authenticates, we update their profile and replace their customized name set by SCIM user provisioning to Okta’s legal name that SAML SSO sees.

There is a feature request that aims to give precedence to SCIM user provisioning over SAML SSO, but there is no progress on that end. For now, customers need to use a workaround described on this page to complete the task.

Important disclaimer

Due to the configuration flow currently adopted by Atlassian, you will need to complete the configuration wizard once to generate your Service provider assertion consumer service URL and Service provider entity URL. In case you don't have these values generated, you will need to complete the wizard with dummy values. 

How to send personalized attributes via the custom SAML SSO app

1. Go to your Okta Admin dashboard and open Applications, then hit Create App Integration

2. Choose SAML 2.0 and click next

3. Give the app any name that makes sense to you (that is, Custom SAML SSO Integration - Atlassian Cloud) and continue to the next screen

4. As Okta Single sign on URL, use Atlassian Service provider assertion consumer service URL and mark the option Use this for Recipient URL and Destination URL

5. As Okta Audience URI (SP Entity ID) uses Atlassian Service provider entity URL

6. As Okta Default RelayState uses Atlassian main hub of services, https://start.atlassian.com

7. For the option Update application username, choose Create and update

8. You now need to configure the SAML attributes according to the below table:

Name	Name format	Value
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname	Unspecified	user.firstName
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname	Unspecified	user.lastName
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Unspecified	user.id

9. For the Group Attribute Statements (optional), please leave them blank

10. And then you can click on preview SAML to check the configuration

11. Go to the next screen and choose the option that better fits your use case to complete the app creation and click finish

12. On the page that will open to you upon completion of the app, scroll down and click on View SAML setup instructions, then follow the tutorial to carry the information to Atlassian

13. Click on View SAML configuration at your Atlassian organization

13. Copy the Okta values from the page you opened by following step 12 to your atlassian organization; after that, click Save

Okta Field	Atlassian Field
Identity Provider Single Sign-On URL	Identity provider SSO URL
Identity Provider Issuer	Identity Provider Entity ID
X.509 Certificate	Public x509 certificat