How can I give Just In Time Portal-Only Customer SSO users access to the correct Project in JSM

[Alex Ferraro]

We have three different Jira Service Manager to act as helpdesks. We want our platform users to single-sign-on to the respective help desk based on their platform profile. We are using Salesforce as an IdP. The connected app has been set up and configured, and SSO does work. But it is automatically giving access to just "portals", and shows knowledge base articles for Admin and nothing else. The test was with a non admin user, and I've learned that I can go into the "people" setting of the project I need this SSO user to see, and I can manually add them, and now SSO takes them to the correct portal.

Is there a way to ensure this automatically? I am able to pass any claims needed in the SAML request, I just don't know if there's a way to receive that information in Jira, and how to establish that permission, or connection.

[Bruna Silva]

Hello @Alex Ferraro,

Thank you for reaching out to Atlassian Community! 

Allow me to share with you that, currently, the customer access to a customer portal is set in the following pages:

• Global customer permissions(affects all the service projects):
  • From the top right of your screen, select Settings in the top right of the screen > Products > Under Jira Service Management, select Customer access

• Project customer permissions(affects only the service project):
  • For Company-managed projects: From your service project, go to Project settings > Customer permissions
  • For Team-managed projects: From your service project, go to Project settings > Channels > Customer permissions

More details about these permissions can be found in the following document:

• Permissions for your service project and Jira site

We also have open feature requests to have more customer permission options, as we can see below:

• More flexible portal-specific customer signup
• Ability to set domain restriction for private Service Desk to allow self-sign up

Please, feel free to click on "Vote for this issue" and add yourself as a watcher to be kept informed about the state of the features moving forward.

If you have any other questions regarding this matter, please let us know.

Regards,
Bruna

[Alex Ferraro]

Hello thank you for your response. Does this mean we have to manually grant access to projects after the user has been created using Single-Sign-On? Our hope is that users who create their own portal-only customer accounts via Single-Sign-On can also be assigned the specific project permissions they need. We can send over a group identifier in the single sign on, but there is nowhere to map that value to in jira to automatically grant channel access per project.

[Bruna Silva]

Hello Alex,

To ensure we can assist you effectively with this case, I have created a support ticket on your behalf.

You should have received an email notification confirming this.

Thank you for understanding. We'll be in touch with you shortly to further understand your scenario and provide the necessary assistance.

Best,
Bruna