In October 2016, we launched an add-on that would allow our Jira Service Desk Data Center offering to support SAML single sign-on. We've worked hard to bundle this with Jira Service Desk so that it works straight out of the box. From Jira Service Desk 3.3, you can now link your Data Center licensed instance to your existing supported Identity Provider (IdP), and provide your users with a single sign-on experience. This reduces the number of passwords a user needs to remember, and provides extra security for your instance.

Please note that this is only available for Jira Service Desk Data Center, not Jira Service Desk Server.

SAML SSO for JIRA Data Center applications & Release notes

Didn't work for us.

Thanks Matt Zuba, I just applied your modification on our instance and it worked. awesome work !

I've been able to mostly solve this for our Server implementation that is using Okta's Jira Authenticator.  Here are the basic steps:

1. Edit  JIRA_INSTALL/conf/context.xml
2. Add the following line to this file. Place this above the line containing </Context>

<Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />

1. Create a file named rewrite.config and place it in the JIRA_INSTALL/atlassian-jira/WEB-INF directory.
   1. The final path should be JIRA_INSTALL/atlassian-jira/WEB-INF/rewrite.config
   2. The user that JIRA runs as must be able to read this file. This file should have the same permissions as the other files in WEB-INF directory.
2. Add the following lines to this file:

RewriteCond %{REQUEST_URI} ^/servicedesk/customer(/.*)?/user/login [NC] 
RewriteCond %{QUERY_STRING} ^destination=(.*)$ 
RewriteRule .* /okta_login.jsp?RelayState=\%2Fservicedesk\%2Fcustomer\%2F%1 [NE,R=307,L] 

RewriteCond %{REQUEST_URI} ^/servicedesk/customer(/.*)?/user/login [NC] 
RewriteRule .* /okta_login.jsp?RelayState=\%2Fservicedesk\%2Fcustomer\%2Fportals [NE,R=307,L]

The first rewrite cond/rule pair captures requests that have a destination parameter and the second captures requests without.  Both redirect to the okta_login.jsp page with the RelayState set so that when okta_login.jsp does the POST over to Okta, it will carry the relay state and return the user to the proper page after login.

For those not using Okta and/or their authenticator, maybe this will give some ideas.

I'll caveat this with the fact that my org's Jira instance is in its infancy, barely into production use, so I'm not sure if this covers any edge cases that might crop up in URLs, but I'd love any feedback or corrections if anyone has them.  For why we're using Okta's integration and not others on the Marketplace, the reason is simple - I prefer Okta's method of provisioning and assigning groups over some of the other solutions out there (User Sync, for example).  I don't mind having to modify files during upgrades, it's very little and the above will just be added to those steps.

There are requests for SAML integration dating back to 2007. Atlassian will never add it.
Atlassian recommends to use Third-party Plugins.

Is there any workaround that we an perform for this ? 

We are redirecting any service desk portal url requests to the base Jira url so users get single signed on, but we need to send them back to their initial request url after being signed on. How can we do this ?

@Avinash Singh

We have in our 7.13 Datacenter instance Settings - System - SAML Authentication. It used to be a separate free Atlassian add-on, but now it is ootb as far as I know. I googled and found https://confluence.atlassian.com/enterprise/adding-saml-integration-to-your-existing-user-management-infrastructure-861244976.html. Looks like it is datacenter only.

hth

Thanks @Martina Riedel, where is this setting that you are referring to ? Or is it through a plugin ?

btw. in 7.13.x the out-of-the box- SAML SSO has a switch that makes it work for us. This issue needs updating I think.

Service Desk settings

Include customer logins
If checked customers using Service Desk will also log in using SAML

We have Jira Software and Jira Service Desk on the same instance. We have integrated with OKTA to provide SAML and SSO capabilities.  Users accessing a service desk url when unauthenticated bypasses the Okta authentication and provides a services desk portal login, which is a security problem for us.