User direcotry and SSO with different groups

[Martin Bens]

Hi,

we are currently using Crowd as a directory provider and a SSO IdP. Crowd itself uses mostly an internal LDAP for user information.

However, we also use local groups in crowd (managing groups via the LDAP is tedious). The groups are mainly used for authorization in Jira and Confluence.

The organization provides another IdP, integrated with several other internal and external services. I would like to use that SAML authentication. There are no additional users in Crowd, only additional groups.

I would like to know if authentication can be done by the IdP and authorization by the Crowd directory?

best regards,
Martin Bens

[Lokesh Naktode_miniOrange]

Hi @Martin Bens 

Looking at the message, it seems you want to use Crowd as a User Directory to manage user's permission for JIRA and Confluence but want to delegate user authentication from Crowd to IDP via SAML. right?

If this is the case, you can easily achieve this requirement using the Crowd SAML SSO plugin and its connector add-ons for JIRA and Confluence.  Crowd SAML SSO plugin allows you to enable SAML SSO from IDP and using the SSO connector, any user accessing the application (JIRA or Confluence) gets redirected to IDP for authentication.

Here, all the SAML authentication requests and responses to and from IDP will go through the Crowd server. The user authentication will be done by the IDP and Crowd can still be used to manage user's permissions.

Let me know if you need more details on this or you can reach out to the miniOrange support for further assistance with the configuration.

Thanks and Regard,

Lokesh

PS: I work for miniOrange. One of the top SSO vendors in the Atlassian Marketplace.

[Martin Bens]

Thx.

That might be exactly what we need. Do I need the premium plan or is the free plan sufficient?

[Lokesh Naktode_miniOrange]

Hi Martin,

In SAML, IDP sends the user information (username, email, etc) in the SAML Response which is used to identify SSO users by mapping the username of the user from IDP to Crowd. If IDP can send the user's Atlassian username (username in Crowd) in the NameID attribute of the SAML Response then the free plugin will work for you. 

But my recommendation is to move forward with the Premium plugin for advanced usability and security features.

Please note that the SSO connector add-on is not free but available for free TRIAL.

Thanks and Regard,

Lokesh

PS: I work for miniOrange. One of the top SSO vendors in the Atlassian Marketplace.