Configure SAML single sign-on for portal-only customers

Connect an identity provider and configure single sign-on for your customers.

About SAML single sign-on for portal-only customers

Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, such as an identity provider and a service provider.

SAML for single sign-on (SSO) allows your customers to authenticate through your organization's identity provider when they log in to your Jira Service Management help center. Customers only need to log in one time to access multiple portals for one help center during an active session.

SAML single sign-on with authentication setting

After you configure SAML single sign-on with your identity provider, you need to enable single sign-on through Jira settings for Jira Service Management. Learn more about authenticating your portal-only customers

Before you begin

Here's what you must do before you set up SAML single sign-on.

• Subscribe to Atlassian Guard Standard from your organization. Understand Atlassian Guard

• Make sure you're an admin for an Atlassian organization. 

• Add an identity provider to Jira Service Management. How to add an identity provider for portal-only customers

• Check that your Atlassian product and your identity provider use the HTTPS protocol to communicate and that the configured product base URL is the HTTPS one.

Here’s what we recommend you do before you set up SAML single sign-on.

• Make sure the clock on your identity provider server is synchronized with NTP. SAML authentication requests are only valid for a limited time.

• Go to the Authentication page under your Jira settings to test the single sign-on experience before enabling SSO for all your portal-only customers. Learn more about testing single sign-on for customer login

Supported identity providers

Your SAML SSO setup depends on the identity provider. The Atlassian support team can help you with the setup instructions for supported identity providers.

Original	Centralized
As a site administrator or organization admin, Users is found under Product site.	As an organization admin, Users is found under Directory tab.

 

Jump to the

• Centralized user management content

• Original user management content

Copy details from your identity provider to your Atlassian organization

1. From your organization at admin.atlassian.com, select Products.

2. Under Sites and products, select the site you want to configure the SAML SSO for.

3. Under Jira Service Management, select Portal-only customers.

4. Select (more option) > Identity providers.

5. Select Set up SAML single sign-on.

6. Add SAML details.

7. Select Save.

Copy these URLs from your Atlassian organization to your identity provider

• Service provider entity URL

• Service provider assertion consumer service URL

To integrate a generic application with your chosen identity provider:

1. Log in to your chosen identity provider account.

2. Look for the option to create your own application.

3. Once inside the application creation area, search for the option to integrate any other application not listed in the app gallery or library.

4. Select this option to proceed with the configuration process.

5. Select Save in your identity provider.

Available SAML attributes

When you set up your identity provider, these are your SAML attributes:

Configure single sign-on to authenticate your customers

We recommend that you test and then enable single sign-on for your Jira Service Managementhelp center. When you enable single sign-on your customers can access your help center using their identity credentials with the identity provider. Learn more about authenticating your portal-only customers

Delete SAML configuration for an identity provider

Once you delete the SAML configuration, your customers won’t be able to authenticate from the identity provider. Instead, they will need to use their portal-only accounts (email and password) on your site to access your help center. If a customer doesn’t have a portal-only account password, we’ll ask them to set it up at the time they attempt to log in to your help center.

Before you delete the SAML single sign-on configured for your identity provider, make sure you have disabled single sign-on and enabled password authentication. Learn how to disable single sign-on and enable password

To delete SAML single sign-on configuration for an identity provider:

1. From your organization at admin.atlassian.com, select Products.

2. Under Sites and products, select the site you want to delete the SAML configuration for.

3. Under Jira Service Management, select Portal-only customers.

4. Select (more option) > Identity providers.

5. Select the directory you want to delete the SAML configuration.

6. Select View SAML configuration > Delete configuration.

When you delete the SAML configuration, you still have a subscription to Atlassian Guard Standard. If you want to unsubscribe, go to Unsubscribe from Atlassian Guard Standard.

Copy details from your identity provider to your Atlassian organization

1. Go to your site's Admin at admin.atlassian.com. If you're an admin for multiple sites or an organization admin, click the site's name and URL to open the Admin for that site.

2. Select Jira Service Management.

3. Select (more option) > Identity providers.

4. Select Set up SAML single sign-on.

5. Add SAML details.

6. Select Save.

Copy these URLs from your Atlassian organization to your identity provider

• Service provider entity URL

• Service provider assertion consumer service URL

To integrate a generic application with your chosen identity provider:

1. Log in to your chosen identity provider account.

2. Look for the option to create your own application.

3. Once inside the application creation area, search for the option to integrate any other application not listed in the app gallery or library.

4. Select this option to proceed with the configuration process.

5. Select Save in your identity provider.

Available SAML attributes

When you set up your identity provider, these are your SAML attributes:

Configure single sign-on to authenticate your customers

We recommend that you test and then enable single sign-on for your Jira Service Managementhelp center. When you enable single sign-on your customers can access your help center using their identity credentials with the identity provider. Learn more about authenticating your portal-only customers

Just-in-time provisioning with SAML

Just-in-time provisioning is supported during both service provider-initiated and identity provider-initiated flows.

You need to be a Jira admin to enable single sign-on for your Jira Service Management site:

1. Go to the Jira settings > Products > Authentication. Learn more about configuring settings to authenticate your portal-only customers

2. Make sure that you have the option Enable single sign-on selected and saved.

Once these settings have been confirmed, a new customer will go to your help center URL https://INSTANCE.atlassian.net/servicedesk/customer/portals to just-in-time provision a portal-only account.

The service provider-initiated login experience in the help center will be:

1. The customer navigates to https://INSTANCE.atlassian.net/servicedesk/customer/portals 

2. The customer enters their Email address and selects Continue.

3. The customer selects Continue with single sign-on and is redirected to their identity provider.

If the customer successfully authenticates against the identity provider (or has a cached session), we automatically create a portal-only customer account for them, and they're redirected back to the help center website that initiated the login.

Delete SAML configuration for an identity provider

Once you delete the SAML configuration, your customers won’t be able to authenticate from the identity provider. Instead, they will need to use their portal-only accounts (email and password) on your site to access your help center. If a customer doesn’t have a portal-only account password, we’ll ask them to set it up at the time they attempt to log in to your help center.

Before you delete the SAML single sign-on configured for your identity provider, make sure you have disabled single sign-on and enabled password authentication. Learn how to disable single sign-on and enable password

To delete SAML single sign-on configuration for an identity provider:

1. Go to your site's Admin at admin.atlassian.com. If you're an admin for multiple sites or an organization admin, click the site's name and URL to open the Admin for that site.

2. Select Jira Service Management.

3. Select (more option) > Identity providers.

4. Select the directory you want to delete the SAML configuration.

5. Select View SAML configuration > Delete configuration.

When you delete the SAML configuration, you still have a subscription to Atlassian Guard Standard. If you want to unsubscribe, go to Unsubscribe from Atlassian Guard Standard.