Problems with Portal only Customer SSO Azure AD (Entra ID)

[Jannick Bettighofer]

Hi guys,

We have tried to connect our Azure AD (Entra ID) for the connection of the portal only customers in Jira Service Management.

We have followed the following instructions for the setup: Configure SAML single sign-on for portal-only customers | Atlassian Support

Now we have the following problem: A customer who is also stored in the application in the Azure AD tries to log in via SSO , but after entering the e-mail address the following error message appears: "You can't continue with single sign-on. Try again." But the authentication is shown as successful in the logs in Azure AD

In the Jira Settings SSO is enabled and the right identity provider is connected.

Is there any hidden setting to configure? Have any of you had experience with this problem?

Best regards and thank you in advance

[Darwish Baganian]

Hi Jannick,

I was able to get mine working. Make sure you follow the guide from Microsoft below especially Step 12:

Tutorial: Microsoft Entra SSO integration with Atlassian Cloud - Microsoft Entra ID | Microsoft Learn

Do both of the attribute mappings so it looks like this

[Michael Friedmann]

Hi there. We have exactly the same error. SSO with redirection works and we have changed the claims as suggested but still the user get's the error message:
error_code=access_denied&destination=portals

It seems like there is still another access policy or right missing that needs to be configured .... Please advise!

[Darwish Baganian]

Hi there. I too am getting the same error message.

Looking at the URL after logging in, it's saying Access Denied:

https://ourdomain.atlassian.net/servicedesk/customer/user/login?error_code=access_denied&destination=portals

Customer Permissions is set to Open and they are also allowed to create accounts.

Not sure why it's not working

[Michael Friedmann]

Hi there,

I could solve my issue with the same error message "You can't continue with single sign-on. Try again." by double checking certificate setup from Azure and copy it again into the Atlassian SAML setup. 

Just to be sure I also have a different SAML Attributes & Claims Setup (I did get this one from Atlassian Guard Support) as shown above:

 In the same page check the SAML Certificates section and download the Base64 version of the certificate:

Make sure to copy it by using a text editor (eg notepad++) and not Word or a tool that might do magic with encoding and paste it here:

Even so I did know that you need to be carful in copying the certificate Base64 encoded and including "BEGIN" and "END...." marks etc. I did obviously a mistake there....  

As far as I understand the issue, the SAML authentication works without but the JIT (just in time provisioning) of a new "customer" is only possible if a trusted source (certificate) delivers the customer data....

Hope this solves your issue as well...