Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,366,822
Community Members
 
Community Events
168
Community Groups

Atlassian Access issues / Authentication Policy missmatch ?/ SSO issue

Hi all,


maybe you can help me:

I have migrated 2 Organisation:

  • Orga A and Orga B
  • Orga A has Atlassian in place.
  • Login to atlassian is done via SSO.

I want to connect users from Orga B to Atlassian Access as well.

I have successfully verified the B-Domain and claimed their users.

  • SSO login to Orga A works
  • SSO login to Orga B does not work

However when trying to access the Orga-B via Atlassian-SSO the login does not work:

https://id.atlassian.com/login/callback?error=unauthorized&error_description=authentication-policy-strategy-mismatch%3FcurrentConnection%xxxxxxxxx%26policyConnection%3Dnull&state=https%3A%2F%2Fstart.atlassian.com%2F

Due to the URL Error I thought this might be related to "recently" released feature "Authentication policies" atlassian released end of last year (https://support.atlassian.com/security-and-access-policies/docs/understand-authentication-policies/)
Keep in mind OrgaA has been created before October2020 and OrgaB just recently

 

In general the SAML connection between our IDP and Atlassian works: 

When updating e.g. the Email addr in the IDP for a user in OrgaB the Email addr will indeed be updated in the user management. 

 

thanks in advance for your help

Felix

1 answer

I don't have an answer but have a similar error.  We have Okta SSO set up and due to a merger, logins are from two domains (both verified).  Users from one can log in but users from the other get the above error.  I will file a support case. 

Did you get a resolution for this error? - we are also seeing this error

In our case we had several problems. One was that the AD attribute mapping needed to be different for each org (email, name, etc. weren't stored the same way in the two source directories), so the identity team added some logic like "if domainA.com, pass X to Atlassian else pass Y to Atlassian".  Another was that the new IdP feature had to be toggled on by Atlassian for our org.  I would reach out to support for this; given that they have added/changed a lot around Access lately (for the better), there could be something non-obvious going on.

That's great thank you 

Suggest an answer

Log in or Sign up to answer
TAGS

Atlassian Community Events