Jira Align Cloud to Jira Software On-Premise Connectivity Prerequisites

[#1]

Purpose

This article will explain the process flow of understanding and completing connectivity between Jira Align and Jira Data Center.

---

1) Review the Documentation and Connectivity Diagrams

1a) Documentation to Review

• Jira Align Traffic Flow

• Jira Align API URLs

• Jira Align & Jira Connectivity

• 10X: Jira Integration Guide – Jira Align

1b) Technical Teams Involved

• System Administrator (Server Admin, Infrastructure)
  • Jira Administrator (Service Account, Jira Align Integration)
  • Network Engineer (Load Balancer, Proxy, API Gateway, Routing)
  • Security Engineer (Firewalls, Intrusion Protection, Compliance)

Customer Actions:

• Which architecture will be used?

• What is the timeline for implementation?

• Which contact(s) will Jira Align work with to establish connectivity?

• Are there any considerations or concerns Jira Align should be aware of?

---

2) Jira Service Account

• Jira and Jira Align Integration: Creating an API Service Account

• Creating a Jira Service Account with Groups and Permission Schemes for Jira Align

Customer Action:

• What is the timeline to create the Service Account?

---

3) Network and Authentication

3a) Network Configurations

• Firewalls
  • Jira Align communicates with Jira Data Center using 2 AWS Elastic IPs. Jira Align will provide you with these 2 IPs as part of the onboarding process.
  • Please make sure that you have allowed these 2 IP addresses through your firewall to Jira Data Center.
  • Make sure that there is a public DNS record that Jira Align can use to connect to your Jira Data Center / API URL.

• Proxies & API Gateways

  • Configure Jira server to run behind a NGINX reverse proxy | Jira | Atlassian Documentation

  • Connecting Jira Align to Jira Data Center with Apigee as a Reverse Proxy

3b) Authentication Methods

• Jira Align and Authentication Methods

Customer Actions: Work with Internal Network/Security Teams to configure their systems to allow for Jira Align connectivity. Determine the best Authentication Method according to current policies and available infrastructure. Basic Auth (Jira Service Account) OAuth 1.0a (Jira Service Account) Personal Access Token (Jira Service Account) Basic Auth (using API Token - Apigee)

---

4) SSL Certificates 

• Jira Align and SSL/TLS

Customer Actions:

• Determine if Mutual TLS is possible in the available infrastructure.
  • Yes
  • No

• Determine which Certificate is preferred.

  • Wildcard Jira Align Certificate (*.jiraalign.com)

  • Custom Jira Align Certificate (Ex: customer.jiraalign.com)

  • Customer-owned Certificate (Ex: jiraalign.customer.com )

• What is the timeline to implement and test Mutual TLS?

---

5) Configuration, Troubleshooting, and Validation

5a) Pre-Checks

• Jira Service Account is configured in Jira Software (see #2).
• Authentication Method is agreed upon (see #3b).
• Mutual TLS is agreed upon (see #4).
• Jira Admin and/or Jira Align Admin available to configure the Jira Connector (see #1b).

If Required

• API Gateway/Proxy rules are configured to allow Jira Align to connect to Jira Software (see #3a).

• Jira Align’s IP Addresses and Ports are Allow Listed at the Edge Firewall (see #3a).

5b) Configuration

• Schedule call to configure?

• Jira Align to Jira Server / Data Center Connectivity Quick Guide

• Jira Align Syncing a Test Project

5c) Troubleshooting

• Troubleshooting session with Sysadmin, Network Engineer, Security Engineer (see #1b).

• Jira Align Connectors Missing

• OAuth Error During Setup Between Jira Align and Jira

5d) Validation

• Jira Connector is setup with Jira Link and Jira API
• Authentication Method is configured and validated
• Mutual TLS is configured and validated
• Data is synced successfully (Prod and Test)

Customer Actions:

• Pre-Checks are completed.

• Determine if a scheduled call to configure is needed and which parties are required.

• Schedule call (if needed).

• Complete configuration and validation.

---

A) SAML/SSO (Optional)

A few things to note:

• Jira Align supports Identity Provider Initiated SAML 2.0 (not Service Provider Initiated)

• Just In Time (JIT) and System for Cross-domain Identity Management (SCIM) are not supported

Articles

• Okta SAML 2.0 Setup for Jira Align

• Azure Active Directory SAML 2.0 Setup for Jira Align

• Ping One SAML 2.0 Setup for Jira Align

• How to Enable Single Sign On SSO with Jira Align

• Jira Align SAML 2.0 Setup