Uploaded image for project: 'Atlassian Guard'
  1. Atlassian Guard
  2. ACCESS-1615

Improve the idle session timeout to reuse a previous SSO session

XMLWordPrintable

    • 6

    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      At this moment, when a user that was previously logged via SSO has their session timed out in accordance with the Authentication Policy Idle session duration value, they are presented with the usual login pop-up: 

      Suggestion:

      Implement a mechanism that would either:

      • Automatically reuse the previous SAML attributes that were provided in the first SSO login, not requiring any extra steps from the end user. 
      • Keep stored, and allow the user to log in using the SAML attributes that were used in the first SSO login via a new button in the interface. For example, provide a new option to trigger the SSO authentication flow using the attributes that were already provided previously. 

        1. image-2023-08-24-13-17-15-519.png
          image-2023-08-24-13-17-15-519.png
          89 kB

          Form Name

            [ACCESS-1615] Improve the idle session timeout to reuse a previous SSO session

            Terry added a comment -

            For my use case, we would like to have click-free seamless SSO, and thus the first option "Automatically reuse the previous SAML attributes that were provided in the first SSO login, not requiring any extra steps from the end user." is the closest fit of the 2. The second option requires the user to interact with another button on an already crowded dialog box so is not desirable for us.

            Ideally, for a particular tenant, we would like the ability to set a tenant-wide (all auth policies) IDP setting that prevents the need for this sign-on IDP selection box in either the first or subsequent SSOs. The user is going to a particular tenant URL, that directs to a tenant-wide defined IDP URL, the user either signs in or their existing IDP sign on is used in a click-free way, then they are returned to the Jira tenant. Where possible, ID of the user is passed to the IDP so that in the case of multiple accounts it can select the correct ID/session to user without user action.  

             

            Terry added a comment - For my use case, we would like to have click-free seamless SSO, and thus the first option "Automatically reuse the previous SAML attributes that were provided in the first SSO login, not requiring any extra steps from the end user." is the closest fit of the 2. The second option requires the user to interact with another button on an already crowded dialog box so is not desirable for us. Ideally, for a particular tenant, we would like the ability to set a tenant-wide (all auth policies) IDP setting that prevents the need for this sign-on IDP selection box in either the first or subsequent SSOs. The user is going to a particular tenant URL, that directs to a tenant-wide defined IDP URL, the user either signs in or their existing IDP sign on is used in a click-free way, then they are returned to the Jira tenant. Where possible, ID of the user is passed to the IDP so that in the case of multiple accounts it can select the correct ID/session to user without user action.    

              4a16647b8e77 Illia Dainatovych (Inactive)
              bd4a89fcb3fe Renan Andrade
              Votes:
              7 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated: