Atlassian Access issues / Authentication Policy missmatch ?/ SSO issue

[felix.weber]

Hi all,

maybe you can help me:

I have migrated 2 Organisation:

• Orga A and Orga B
• Orga A has Atlassian in place.
• Login to atlassian is done via SSO.

I want to connect users from Orga B to Atlassian Access as well.

I have successfully verified the B-Domain and claimed their users.

• SSO login to Orga A works
• SSO login to Orga B does not work
  

However when trying to access the Orga-B via Atlassian-SSO the login does not work:

https://id.atlassian.com/login/callback?error=unauthorized&error_description=authentication-policy-strategy-mismatch%3FcurrentConnection%xxxxxxxxx%26policyConnection%3Dnull&state=https%3A%2F%2Fstart.atlassian.com%2F

Due to the URL Error I thought this might be related to "recently" released feature "Authentication policies" atlassian released end of last year (https://support.atlassian.com/security-and-access-policies/docs/understand-authentication-policies/)
Keep in mind OrgaA has been created before October2020 and OrgaB just recently

In general the SAML connection between our IDP and Atlassian works: 

When updating e.g. the Email addr in the IDP for a user in OrgaB the Email addr will indeed be updated in the user management. 

thanks in advance for your help

Felix

[John Price]

I don't have an answer but have a similar error.  We have Okta SSO set up and due to a merger, logins are from two domains (both verified).  Users from one can log in but users from the other get the above error.  I will file a support case. 

[Gareth Blake-Coggins]

Did you get a resolution for this error? - we are also seeing this error

[John Price]

In our case we had several problems. One was that the AD attribute mapping needed to be different for each org (email, name, etc. weren't stored the same way in the two source directories), so the identity team added some logic like "if domainA.com, pass X to Atlassian else pass Y to Atlassian".  Another was that the new IdP feature had to be toggled on by Atlassian for our org.  I would reach out to support for this; given that they have added/changed a lot around Access lately (for the better), there could be something non-obvious going on.

[Gareth Blake-Coggins]

That's great thank you