Problems with Azure AD and Admin Login via Kantega SSO

[Sport-Thieme GmbH]

Hello,

we have a own selfhosted Jira Service Desk.

We installed the plugin for Azure AD SSO names: Kantega SSO.

The plugin works fine but we have some problems with the administration center in Jira.

we have internal administration users via jira directory. this logins in the administration center work`s fine.

also we have administration users via Azure AD with problems.

The problems are:

the administration user logged in in Jira - thats works fine.

the administration user navigate to system and a second authentification for the administration center pops up. 

after entering the password we have authenticationproblems:

Can you help me?

Entschuldigung, wir hatten technische Probleme während ihrer letzten Aktion.

Fordern sie Unterstützung an

Kopieren sie den Inhalt unten und senden sie ihn an ihren Jira Administrator

Technische Details

Verweisnummer des Protokolls: 53ce9b65-58c0-45ca-8d09-df7807e8c704

Ursache

Verweiser-URL: https://jira.sport-thieme.de/secure/admin/user/UserBrowser.jspa

com.atlassian.crowd.exception.runtime.OperationFailedException: Bad Request

com.atlassian.crowd.exception.runtime.OperationFailedException: Bad Request
	at com.atlassian.crowd.embedded.core.CrowdServiceImpl.convertOperationFailedException(CrowdServiceImpl.java:664) [embedded-crowd-core-2.10.4.jar:?]
	at com.atlassian.crowd.embedded.core.CrowdServiceImpl.authenticate(CrowdServiceImpl.java:76) [embedded-crowd-core-2.10.4.jar:?]
	at com.atlassian.jira.security.login.LoginManagerImpl$InternalStaticDependencies.authenticate(LoginManagerImpl.java:375) [classes/:?]
	at com.atlassian.jira.security.login.LoginManagerImpl.authenticateWithoutElevatedCheck(LoginManagerImpl.java:199) [classes/:?]
	at com.atlassian.jira.web.action.admin.WebSudoAuthenticate.doValidation(WebSudoAuthenticate.java:116) [classes/:?]
	at webwork.action.ActionSupport.validate(ActionSupport.java:391) [webwork-1.4-atlassian-30.jar:?] 

[Jon Espen Ingvaldsen Kantega SSO]

Hi @Sport-Thieme GmbH.

The username / password popup you get is most likely because the combination of:

• "Web sudo" is enabled in your Jira environment.
• You have your admin users in Azure AD and the use the cloud connector synchronize users with Jira. Even though this connector synchronize user attributes, the password remains in Azure AD (not exposed to the Atlassian environment).

The web sudo authentication fails as there is no password to validate in Jira.

I believe also that the error message shown in your log capture is caused by the failed web sudo authentication.

There are two options to solve this:

1) Disable web sudo: https://community.atlassian.com/t5/Jira-Core-questions/How-can-I-set-jira-websudo-is-disabled-to-false/qaq-p/92153

2) Create admin users in the Jira internal user directory (traditional user accounts where the passwords are known to Jira). 

Hope one of these are suitable for your scenario.

Regards,

Jon Espen

Kantega SSO