SAML Azure JIRA Cloud Configuration Errors

[Mary C Wilson]

We have followed the instructions mentioned in https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-atlassian-cloud-tutorial, but are currently getting the following response.

Oops, there was an error logging you in.

Please contact your administrator to check single sign-on configuration.

Error reference: . Error reported: Invalid issuer in the Assertion/Response

Any help would be greatly appreciated as Atlassian support claims they don't see any errors and isn't much help. They keep saying the identifier is wrong, but we have it set to https://id.atlassian.com/login.

[Brant Schroeder]

Place a / on the back of the identity provider entity ID url.

[Mary C Wilson]

I tested changing the entity ID with a slash and received the following errors.

Error with Entity ID: https://id.atlassian.com/login/ 

[Mary C Wilson]

I'm unclear if we're putting the / on both the Azure and JIRA sides or just one side?

[Brant Schroeder]

In the JIRA config the Identity provider Entity ID text box should have the SAML Entity ID which you copied from Azure portal this should end in a /.  In the Identity provider SSO URL should have the SAML Single Sign-On Service URL which you copied from Azure portal and should not have an ending /.   Add the certificate and save the settings.   Make sure that Azure AD settings have the correct identifier URL and test again.

[Mary C Wilson]

Hmm.  Thanks so much for trying to help!!  This is what we have - still getting the oops error:

JIRA Side:

Identity provider Entity ID: https://sts.windows.net/afd68e8f-a6e1-499f-9638-dceea8479772/

Identity provider SSO URL: https://login.microsoftonline.com/afd68e8f-a6e1-499f-9638-dceea8479772/saml2

Azure Side:

Identifier:  https://id.atlassian.com/login

Reply URL: https://id.atlassian.com/login/saml/acs

[AgentSmith]

According to the instructions that follow:

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-atlassian-cloud-tutorial

... the identifier URL should be as so:

https://<instancename>.atlassian.net/admin/saml/edit 

hoping this helps 

[Brant Schroeder]

This is caused by the incorrect Single Sign-on Issuer configured. Make sure you have copied the entityID attribute correctly, including the trailing slash.

[Mary C Wilson]

We've copied it directly from the embedded Azure configuration, but are continuing to get the error.

[Mary C Wilson]

[Mary C Wilson]

and our JIRA SAML config: