SAML for Service Desk customers?

[Dirk Festerling]

We are using Service Desk Cloud as an internal support tool for our company users. Most of them handle their issues by email. Some make even use out of the support portal, but most don't even know the password of their accounts. Because they have been created automatically when they sent the first email.

I would like to promote the usage of our portal, offer some confluence FAQ articles there etc. But having to sign in  is a nuicance for the customers... Now I figured out that we could use Identiy-Manager to provide single sign on even to my customers, because all have email adresses with the same (managed) domain.

After talking with Atlassian license support, I understood that in future all managed accounts (even the one for Service Desk customers) will be billed with 3 USD per user and month. We have round about 200 active users in our company and I would have to create a (billed) account for everyone (if I see that somebody joined the company)... In addition, I have no idea how to handle resigned users... They keep billed unless I disable them, but since they are not part of our team, I don't know about their leave...  In the end I will have a monthly bill of at least 600 USD that keeps growing - completeley out of my control...

Obviously I can't justify the usage of Identiy-Manager under that circumstances. Are there any alternatives to use Atlassian's cloud services and still provide a smooth experience to my customers?

Thanks a lot for your input and best regards!
Dirk

[Ed Letifov _TechTime - New Zealand_ · Accepted solution]

Hello, @Gert-Jan van der Kamp 

I am pretty sure the SP doesn't actually care what the IdP is, as long as it follows the standards in its responses.

If yours is fully compliant then it should just work. Have you actually tried and found problems?

I suppose you will have to figure out the IdP side of the setup by yourself though, and since it's proprietary – you are unlikely to get help from anywhere...

[Gert-Jan van der Kamp]

Hi sorry for late reply I got distracted. What is SP exactly and where could I find that setting? Thanks in advance, GJ

[Ed Letifov _TechTime - New Zealand_]

SP = "Service Provider" in this case Atlassian Access.

IdP = "Identity Provider" in this case your own token server.

If IdP follows the standard, there is not way for a SP to tell what exactly it is talking to. So if you figure out how to configure your IdP to talk to Atlassian Access it will work.

The main issue here is that Access does not support OIDC, only SAML.

If you trust 3rd parties to handle your authentication you can work it via a bridge, see here: https://community.atlassian.com/t5/Atlassian-Access-articles/Log-into-Atlassian-Cloud-using-External-OAuth-OIDC-Provider/ba-p/1731169

[Gert-Jan van der Kamp]

That's a great article thx. It does seem however this is not supported out of the box so that's less good news. I may have to park this for now. Guess having people enter their email for their first issue good enough for now. Thanks!