issuer must be a valid URL or URN

[Hamish Moffatt]

I'm new to Access and I'm trying to set up SAML to authenticate against my Keycloak server.

When I try to add the SAML configuration it asks for my public x509 certificate. I got this from Keycloak, but then I get an error saying that the "issuer must be a valid URL or URN".

The common name in the certificate is just set to "<My Company Name>" and not a URL. I don't see how to change this in Keycloak.

Is that the cause of the problem? Is there a way to get around this?

[Richard White _TechTime_ · Accepted solution]

Hi @Eva Kasiak 

Firstly - there is nothing from Atlassian's side stopping the customer from adding an additional JSM instance for your team within the old existing Organisation. Is there a reason within the customer that this option is off the table? Since per user costs of Access also go down at higher user tiers it will most likely be less expensive as well. 

Second, if the users are claimed via the existing Access subscription, there is absolutely nothing stopping you creating the new JSM instance in a new organisation and inviting users that are claimed by the old organisation. In this case the main downside is that the users Access subscription will be paid for and managed via the old organisation (and JSM license paid by new org). Again, this may be ok or not depending on the organisation.

Also, there is an EAP for some functionality that might help if the users are really mutually exclusive (ie. the users for team that needs new JSM would never need any of the products managed by the existing organisation) - where each organisation could claim just a subset of the managed users:
https://www.atlassian.com/wac/roadmap/cloud/multi-org-domain-claims?p=34230be2-ab. There is a comment from an Atlassian on this ticket: https://jira.atlassian.com/browse/ACCESS-1450 which provides an email if this EAP would work in your case.

[Eva Kasiak]

Hey @Richard White _TechTime_  this was indeed helpful with the roadmap and the requests links. I have a meeting next week with Atlassian Technical person who will help us to dive deeper into the solution. But assuming the multi org domain claim is launch I think it should help us to achieve what we're looking for. Thanks a milion for taking the time and responding to my question :)