Uploaded image for project: 'SAML for Atlassian Data Center'
  1. SAML for Atlassian Data Center
  2. SAMLDC-77

As an administrator I would like to transform JIT synchronized groups names (aka group name mapping)

XMLWordPrintable

    • Icon: Suggestion Suggestion
    • Resolution: Unresolved
    • Icon: Low Low
    • None
    • None
    • None
    • None

      Problem Definition

      Since groups synchronized to Atlassian applications can be used to assign permissions (project, space, etc), some group names from the IdP might not be easily recognized by users.

      It would be interesting to an Atlassian administrator to have the ability to map groups synchronized by JIT to internal groups, with different names.

      The same feature would be useful when configuring JIT with Azure AD.
      Azure AD would send only the group ID (Azure Active Directory Group ObjectId) through SAML.
      This feature would enable Azure AD customer to enable JIT in their instances.
      More details in Configure group claims for applications with Azure Active Directory.

      Note that sAMAccountName can be used for groups synchronized from on-prem AD, but not for groups created directly on Azure AD.

      Suggested Solution

      Provide a feature to map the name of groups synchronized from the IdP to new names.
      This is similar to a feature provided by other Marketplace Apps:

        1. screenshot-1.png
          screenshot-1.png
          47 kB

            [SAMLDC-77] As an administrator I would like to transform JIT synchronized groups names (aka group name mapping)

            Sung Cha added a comment - - edited
            1. Set it like the SS below. (edit: adding in more text as I am not sure if the SS showing)
              1. Add a new group claim in the AAD SSO / Enterprise App
              2. Select "Groups assigned to the application"
              3. Check "Customize the name of the group claim" in Advanced Options
              4. Type in "groups" in the "Name (required)" field.  This must match what you put in for the group attribute name in the JIT section.  Case matters.
              5. Make sure Namespace blank.  JIT is just looking for "groups", not the long http://schemas.../groups, etc...
            2. Add the AAD group to the user role in the SSO / Enterprise App.
            3. 3. Have the group precreated in Jira, and also give it rights to the application and/or project in advance. 
            4. Add user(s) to the group and test. 

             

            We have it working like this with AADSSO and JIT.

             

            Sung Cha added a comment - - edited Set it like the SS below. (edit: adding in more text as I am not sure if the SS showing) Add a new group claim in the AAD SSO / Enterprise App Select "Groups assigned to the application" Check "Customize the name of the group claim" in Advanced Options Type in "groups" in the "Name (required)" field.  This must match what you put in for the group attribute name in the JIT section.  Case matters. Make sure Namespace blank.  JIT is just looking for "groups", not the long http://schemas.../groups, etc... Add the AAD group to the user role in the SSO / Enterprise App. 3. Have the group precreated in Jira, and also give it rights to the application and/or project in advance.  Add user(s) to the group and test.    We have it working like this with AADSSO and JIT.  

              Unassigned Unassigned
              tmasutti Thiago Masutti
              Votes:
              24 Vote for this issue
              Watchers:
              29 Start watching this issue

                Created:
                Updated: