TABLE OF CONTENTS
- Introduction
- Creating the JIRA SAML Service
- Review and configure the following settings in the General Info tab:
- Set up SSO for Atlassian Using Octopus Authenticator IdP
Introduction
This document describes the configurations required for SAML 2.0 integration between the Octopus Authenticator and Atlassian Jira
The integration process involves the following sequential phases:
- Creating the Atlassian Jira SAML Service in the Octopus Management Console
- Configuring the 3rd Party IdP and Role in Atlassian admin
- Completing Service Integration
Creating the JIRA SAML Service
The following procedure explains how to create the required SAML service in the Octopus Management Console. The service settings will be used later when you configure the IdP setup in your Atlassian Jira admin account.
To add and configure the JIRA SAML service:
2. Review and configure the following settings in the General Info tab:
Setting | Value / Notes |
Service Name | Atlassian Jira |
Issuer | Atlassian |
Description | Octopus authentication for JIRA web service |
Display icon | This icon will be displayed on the Login page for the service. To change the default icon, click and upload the icon of your choice. |
Login Page URL | <https://<Enterprise Base URL>/saml/<No.>/login> |
3. At the bottom of the tab, click Save.
Note: You will set the service parameters (in the Parameters tab) later, after setting up the 3rd party IdP in your JIRA Admin account.
4. Open the Sign on tab and configure the following settings. It is recommended not to change default settings.
Setting | Value | |
Check Password | Disabled (default setting) |
|
Single Sign-on (SSO) | Disabled (default setting) |
|
Bypass Unenrolled Users | When enabled, users who are known to the system but have not yet enrolled a mobile device or workstation will be allowed to login with username and password (without MFA). |
|
Portal Automatic Launch | This toggle is enabled when SSO is used. When the setting is selected, the SAML service will open immediately upon successful login to the User Portal |
|
Force Login Page | When selected, users will be presented with the Login page for the service, where they select an authentication method everytime they login.
When Force Login Page is NOT selected (default setting), the Login page is presented on the first login to the service. Afterwards, the system recognizes users who have previously logged in and automatically authenticates them based on information stored in the browser. (Users who want to change their authentication method can clear browser data by selecting the Clear Authenticator Preferences self-service option in the User Portal.)
Note: The Force Login Page setting is disabled when Single Sign-on (SSO) is selected. |
|
Sign on Method | SAML 2.0 |
|
Issuer URL | The URL used by the service to connect to Octopus Authenticator, e.g., https://<Enterprise base URL>/saml/<No> |
|
SAML 2.0 Endpoint (HTTP) | The URL used by the service to communicate with the SAML Login page, e.g., https://<Enterprise base URL>/saml/login |
|
SAML Logout URL | The URL to which users are redirected when they log out of the service. |
|
X.509 Certificate Fingerprint | The calculated fingerprint of the generated X.509 certificate. |
|
SAML Signature Algorithm | SHA-256 |
|
X.509 Certificate | X.509 certificate for the Octopus Authenticator JIRA service |
|
SAML Metadata URL | Link to download Service metadata |
|
Custom Message | The message that is shown to the user upon successful login. |
|
Allow access from external network | When enabled, users can authenticate to this server even from outside of the organization |
|
5. At the bottom of the Sign on tab, click Save.
6. Open the Directories tab, and select the checkboxes of the directories to be
integrated with the service. Then, click Save.
7. Open the Users tab and click Add.
A popup opens, with a list of directories displayed on the left.
8. Expand the relevant directory and select the checkboxes of the groups and users
that you want to add to the service. Then, click Save to close the popup.
The groups and users you selected are listed in the Users tab.
9. Click Save. Then, from the toolbar at the top of the page, click PUBLISH and publish your changes.
Set up SSO for Atlassian Using Octopus Authenticator IdP
1. Login to your Atlassian account as an Administrator (https://admin.atlassian.com/)
2. From Jira “Administration” main page, under “Security Tab” category, select “SAML Single Sign-On” option
3. Click “Edit Configuration”
Field name | Field value |
Identity Provider Entity ID | The Octopus Authentication Atlassian JIRA Sign-On Issuer URL. (e.g. http://<Enterprise base URL>/saml/<No.>) |
Identity Provider SSO URL | The Octopus Authentication Atlassian JIRA Sign-On SAML 2.0 Endpoint (HTTP) URL. (e.g. http://<Enterprise base URL>/generic-saml/<No.>/login) |
Public x.509 certificate | The Octopus Authentication Atlassian JIRA Sign-On X.509 Certificate (Copy button) |
4. Click “Save configuration”
5. Upon successful SAML setup, you will receive your Jira SAML Single Sign-On parameters:
- SP Assertion Consumer Service URL (also known as ACS URL)
- SP Entity ID
To complete the Octopus Authenticator and Jira Software SAML Integration, you will require configuring the two Jira SAML parameters under the Atlassian Jira SAML service Parameters tab
- ACS URL – Type the Jira SAML Single Sign-On SP Assertion Consumer Service URL
- Audience Value – Type the Jira SAML Single Sign-On SP Entity ID URI
6. Click “Save Settings”