Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Deleted user
0 / 0 points
Next:
badges earned

Your Points Tracker
Challenges
Leaderboard
  • Global
  • Feed

Badge for your thoughts?

You're enrolled in our new beta rewards program. Join our group to get the inside scoop and share your feedback.

Join group
Recognition
Give the gift of kudos
You have 0 kudos available to give
Who do you want to recognize?
Why do you want to recognize them?
Kudos
Great job appreciating your peers!
Check back soon to give more kudos.

Past Kudos Given
No kudos given
You haven't given any kudos yet. Share the love above and you'll see it here.

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Migrating to SAML. Test environment, and user logout questions.

Hi Everyone,

 

I am looking to migrate my organisation to use SAML single sign on, specifically with Azure AD, and have some a couple questions about the process.

One, is is possible to have some test environment, to ensure that SAML is working correctly, without affecting my users logins? Since Atlassian Access is configured organisation wide, I can't create a separate site to test in, can I?

Two, since user sessions will persist through the migration to SAML (as far as I have gathered from the documentation), will I need to have my users log out, then log back in before I would be able to manage their access through my identity provider (Azure AD)? If a user hasn't logged in with SAML, I would think that their session is not associated with their account on the ID provider. Or is the ability to disable users from the ID provider only available once I set up user provisioning?

 

Cheers,

Harry

2 answers

2 accepted

1 vote
Answer accepted
Dave Meyer Atlassian Team Aug 08, 2019

Hi Harry,

Apologies for the delay in getting back to you. Yes, you’re correct that creating a separate test site won’t have any effect since SAML is configured for your organization based on n the domains that you have claimed. Our recommended method for testing is to verify a test domain for your organization, like “test.yourdomain.com” and create a couple users in Azure AD with emails on that domain. Then go ahead and configure SAML with Azure AD and you can test it out with those users. Once you’re satisfied, you can go ahead and verify your production domain and the SAML settings will automatically apply to all users on your production domain, across all sites they access.

I will check with our team about your question on sessions.

Cheers,

Dave

Using another domain to test will help, thank you for the suggestion.

I look forward to hearing back from you about user sessions.

Hey,

 

I was looking forward for a same solution. Having Azure Ad SAML. Any document that can help me setting this up please?

1 vote
Answer accepted

Hi Harry,

Following up on the second half of your question - setting up SAML will not terminate existing user sessions. SAML SSO will kick in when the user logs out and logs back in. At that time, if the user is disabled in the IDP, the log-in attempt will be rejected. If you want access to be revoked immediately after the user is disabled in the IDP, user provisioning via SCIM is what you need. Let me know if this answers your question.

Best,

Narmada

Hi Narmada,

Not everyone in my company needs an Atlassian account, so would it be possible to set up SCIM to allow me revoke access immediately via the IDP, but not actually provision new users if they log in with an email on my verified domain?

If this isn't possible, then is there a way to force log out a user as an admin?

Cheers,

Harry

It looks like this is possible by controlling the "app assignments" in Azure AD, so that's all I need to know. Thank you for your help.

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Atlassian Access

What's new in Atlassian Access - Webinar

Based on your valuable feedback, we have released several new features to help you gain administrative flexibility with authentication policies, visibility into shadow IT with automatic product disco...

48 views 0 2
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you