Jira Cloud SSO - ADFS

[Matt Gallagher]

Hello,

Hoping someone will be able assist with this ask. I have successfully setup SSO for our ADFS (on prem not cloud). During testing, the values are passed and saml stack tracer shows all is good. The problem is a redirect back to our /adfs/ls/ prompting the user to enter domain username and password. Upon which they are redirected to the startpage. As this "works" it is only a cache of their credentials and will be prompted again when the session token expires. This is not acceptable. 

The guide followed is located here: https://confluence.atlassian.com/cloud/configure-saml-single-sign-on-with-active-directory-federation-services-ad-fs-975020616.html?_ga=2.266415374.1227830942.1594227757-1489549613.1594227757

Also, we do have an odd configuration with user UPN. As the username does match the email address. Typically this resolved by creating a claim to pass SAM as name ID and transform email to name ID.

Thank you.

[Ed Letifov _TechTime - New Zealand_]

If it is your /adfs/ls/ that is prompting the user, then it's a problem on your ADFS side.

If by "prompting" you mean "domain credentials popup" – ADFS is probably trying to do NTLM/Kerberos authentication of the user. Are you accessing your cloud from a domain-joined machine i.e. is NTLM/Kerberos even possible for you? If not, then this authentication mechanism needs to be disabled for external networks – this would be on ADFS side. Also check if your ADFS host is recognised as being in Intranet Zone in IE/Internet Options – transparent SSO won't be possible otherwise.

If this is a regular web form from ADFS, then what you describe is exactly how it should work. ADFS logs the user in, stores this fact in a cookie, redirects back to Service Provider (Atlassian Cloud), when the session expires it will prompt again indeed. What were you expecting?