Okta/Atlassian Access - Hide app from select users

[Neil Azzaro]

We have a fully working Atlassian Access/Okta integration at this time.  The one downfall we're facing is that we have significantly fewer Confluence users as we do Jira users.  In the pre-built integration, you can show or hide Jira and Confluence for all users.  There is no way to hide the tile for users that aren't assigned an actual license (that I'm aware of).

Is there an SP-initiated login URL I could use as a Bookmark-app and hide Confluence from the default integration?  The number of access requests we're seeing is a bit ridiculous.  Or perhaps a 'Generic' configuration that I could use to separate the tiles? 

[Dave Meyer · Accepted solution]

Hey Neil,

This might be a better suggestion for Okta, as they control the behavior of the Atlassian application on the Okta dashboard. We have raised the limitations of the current Atlassian tile with them but don’t have a timeline on a potential solution.

The best solution today is to set up a bookmark app for that points to id.atlassian.com, this will redirect users to start.atlassian.com post-SAML handshake. From there they can select any of the apps they have access to on the Atlassian (or jump straight to a page or issue!)

Regards,

Dave

[Quentin Roberts]

@Neil Azzaro - I ran into this same use case and I found a better workaround than what was suggested by Dave.

You can use the native Atlassian Okta app and set it so that it only shows a tile for 1 of your Atlassian products (Jira, Confluence, Statuspage, Trello, Bitbucket, or Jira Service Management).

Whichever of the apps you are showing a tile for, in Okta, under Advanced Sign-on Settings for the Atlassian app, change the base URL for that product to go to https://id.atlassian.com instead of your organizations unique URL. For our use case, most people are familiar with Jira so we are only showing the Atlassian Jira SAML tile on our Okta dashboard and I set the Jira Base URL to https://id.atlassian.com . So when users click the Atlassian Jira SAML tile, the SAML handshake completes and the user is redirected to https://id.atlassian.com and Atlassian redirects them to https://start.atlassian.com/ and they see the products that they have access to from there. No need for the user to enter any email addresses and this acts as a proper SSO method.