Open issuesSwitch filter

Hello 01d943550371, have you tried the "remember" check box on the login dialogue? If you did, you do not have to enter the email, you only have to press "next". 

The Atlassian login for "fresh users" goes over 2 steps:

• First the user is authorized against the SSO server defined by the company that owns the email address. The Atlassian account is used for multiple site URLs and you can check your profile without accessing any site. 
  Here, Atlassian needs to know the email address of the user. If user was logged in before, Atlassian can remember the email address.
• In a second step, when users accesses the site URL, the ORG of the site can define if they want another check. There, you can use your own SSO server (in the "Externals" setting under Security in the admin gui). At that time user has already done the login of step 1.
  This means that if I have users with an email address not from my domain (e.g. some supplier), they have to do 2 SSOs: First in their own company, then in our SSO.

This 2 steps come from the fact that Atlassian accounts are independent from any site. If you allow only users with email from your own claimed domains, step 1 and step 2 are combined.

As special case, there could be a solution if you have not allowed such "external email addresses" on your site and you have SSO enabled for your claimed domains. 

But most users complain that they have to "enter" their email address - if they just set the "remember" checkbox, it would be just a click. That solution is good enough for me, and it was rolled out some months ago.

> Of course, Atlassian cannot know which SSO server is responsible for the user on a new session. User has to enter an email address at least once.

I don't think that is true. If Atlassian knows which SSO to contact based on email address, there is no reason they can't configure the same SSO based on the URL domain. Why do I have to enter erich@stateuniv.edu when I've already attempted to go to https://stateuniv.atlassian.com? Could there be some clients that allow users from multiple SSO regimes to access their wiki material? I suppose. Those suckers will still have to enter their email address. If ALL of the restricted wiki pages in our wiki ONLY allow access if authorized by a single SSO entity, then we should not need to enter our email address (until we hit the IdP).

I don't think there has been an improvement either. I still have to enter my email address with Atlassian every. single. time. They pass me to Microsoft where I have to enter my email address again, and finally I reach the IdP where I have to enter actual credentials. Every other provider seems to be able to pass me directly to our SSO page without much trouble, but apparently, it's too difficult for Atlassian to figure out.

In the context of this ticket:

• Of course, Atlassian cannot know which SSO server is responsible for the user on a new session. User has to enter an email address at least once.
• After that, why does Atlassian not just prefill the login form with the email address of the last user (store it in a cookie, just like all other Atlassian cookies) and forget it only if the user presses "Logout" in the menu? 

Atlassian has improved the situation (a bit) as the re-confirmation of accounts (aka "daily login") does now remember the email, and login needs only one click, at least if the user is already logged into their SSO provider. Same dialog could be used on "login", too.

The timeout for login after inactivity can be configured in the IDP settings, btw., it does not need to be "daily". We keep it on daily (or shorter) as Atlassian does not handle web calls from SSO provider, when the user logs out there, or is logged out: https://jira.atlassian.com/browse/ACCESS-702. So we have to check often if the user is still logged in at our SSO, to ensure access to our Atlassian data is terminated.