Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Atlassian Access issues / Authentication Policy missmatch ?/ SSO issue

felix.weber February 23, 2021

Hi all,


maybe you can help me:

I have migrated 2 Organisation:

  • Orga A and Orga B
  • Orga A has Atlassian in place.
  • Login to atlassian is done via SSO.

I want to connect users from Orga B to Atlassian Access as well.

I have successfully verified the B-Domain and claimed their users.

  • SSO login to Orga A works
  • SSO login to Orga B does not work

However when trying to access the Orga-B via Atlassian-SSO the login does not work:

https://id.atlassian.com/login/callback?error=unauthorized&error_description=authentication-policy-strategy-mismatch%3FcurrentConnection%xxxxxxxxx%26policyConnection%3Dnull&state=https%3A%2F%2Fstart.atlassian.com%2F

Due to the URL Error I thought this might be related to "recently" released feature "Authentication policies" atlassian released end of last year (https://support.atlassian.com/security-and-access-policies/docs/understand-authentication-policies/)
Keep in mind OrgaA has been created before October2020 and OrgaB just recently

 

In general the SAML connection between our IDP and Atlassian works: 

When updating e.g. the Email addr in the IDP for a user in OrgaB the Email addr will indeed be updated in the user management. 

 

thanks in advance for your help

Felix

1 answer

0 votes
John Price
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
August 3, 2022

I don't have an answer but have a similar error.  We have Okta SSO set up and due to a merger, logins are from two domains (both verified).  Users from one can log in but users from the other get the above error.  I will file a support case. 

Gareth Blake-Coggins September 13, 2022

Did you get a resolution for this error? - we are also seeing this error

John Price
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
September 14, 2022

In our case we had several problems. One was that the AD attribute mapping needed to be different for each org (email, name, etc. weren't stored the same way in the two source directories), so the identity team added some logic like "if domainA.com, pass X to Atlassian else pass Y to Atlassian".  Another was that the new IdP feature had to be toggled on by Atlassian for our org.  I would reach out to support for this; given that they have added/changed a lot around Access lately (for the better), there could be something non-obvious going on.

Gareth Blake-Coggins September 14, 2022

That's great thank you 

John.Chung
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
February 28, 2024

do you have solution

We have 2 organization A,B

each organization auth different email domain

Org A auth email domain users @ovspa.com

Org B auth email domain usres @gcc.computo

all @a.com,@b.com, @c.com belong to our AD

users login Org A can auth by our ADFS

users login Org B, after auth by ADFS (same)  it return error  error=access_denied&error_description=authentication-policy-strategy-mismatch

 

do you have solution to fix it?

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events