Versions Compared

Version Old Version 12 New Version Current
Changes made by

Christian Reichert

Jaime Capitel

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Warning

!!! We

are currently migrating

have migrated this Cloud Instance to our own hosted Server instance !!!

Please follow this link to get to the content you wanted: https://wiki.resolution.de

/display/SSSO/Setup+SAML+SSO+with+ADFS+%28JIRA%29+-+0.14.5

/doc/saml-sso/latest/all/setup-guides-for-saml-sso/microsoft-ad-fs

Thanks for your understanding.


Anchor
Top
Top

This setup guide describes how to complete the initial setup for SAML Single Sign On (SSO) for JIRA with ADFS, applicable for plugin version from 0.14.5. If you need any further support please feel free to contact us here. 

...

Step 2: Setup the ADFS   
Anchor
Step2
Step2

Substep A: Copy/Download the SAML Metadata URL

Expand
titleDo substep A1 if your ADFS has connection to your JIRA instance.

Substep A1:

      • Copy the SAML Metadata-URL from your SAML Single Sign On config page.

    Image Removed

Expand
titleDo Substep A2 if your ADFS has no connection to your JIRA instance or if Step C1 below failed.

Substep A2:

      • Save the linked metadata.xml of the SAML Metadata URL from your SAML Single Sign On config page.
      • Move the saved metadata.xml to your ADFS on a location your choice.

Image RemovedSubstep B: Start the Add Relying Party Trust Wizard

The rest of Step 2 will be completed in AD FS. 

  • Open the AD FS 2.0 Management Console and select Add Relying Party Trust to start the Add Relying Party Trust Wizard.

      Image Removed

  • Click the Start Button to start the wizard.

      Image Removed

Image Removed

Substep C: Insert your SAML Metadata

...

titleDo Substep C1 if you completed Step A1.

Substep C1:

  • Select Import data about the relying party published online or on a local network and paste in the SAML Meta-URL from JIRA in the Federation metadata address (host name or URL) field.
  • Click Next.

      Image Removed

Info
If an error is appeared after clicking on Next button, check the connection from ADFS to the JIRA instance. If you can't build up a connection, start a new wizard and begin with Step A2.
Expand
titleDo Substep C2 if you completed Step A2.

Substep C2:

  • Select Import data about the relying party from file and browse to your metadata.xml location with the Browse... button or fill in your location directly.
  • Click Next.

      Image Removed

Back to Top

Image RemovedSubstep D: Finish the Add Relying Party Trust Wizard

  • Fill the field Display name with a name of your choice.
  • Click Next.

      Image Removed

  • Select I do not want to configure multi-factor authentication settings for this relying party trust at this time.
  • Click Next.

      Image Removed

  • Select Permit all users to access this relying party.
  • Click Next.

      Image Removed

  • Click Next.

      Image Removed      

Info
If an error is appeared after clicking on Next button, check if you have added the same relying party already.
  • Check the Open the Edit Claim Rules dialog for this relying party trust then the wizard closes checkbox to open the Edit Claim Rules dialog after closing the wizard.
  • Click Close to finish the Add Relying Party Trust Wizard.

      Image Removed   

Back to Top

Image Removed

Substep E: Add Name ID as Claim Rule

JIRA needs a Name ID (on the normal case) from the SAML Response to authenticate users. So we need to add a claim rule on ADFS, which add the Name ID in every SAML Response from ADFS.    

Expand
titleIf you didn't tick "Open the Edit Claim Rules dialog...", then it's necessary to open it manually for your Relying Party Trust, following steps here.
  • Navigate to ADFS → Trust Relationships → Relying Party Trusts on the left Navigation panel.
  • Select your Relying Party Trust.
  • Click on Edit Claim Rules... on the right Actions panel.

Image Removed

Otherwise, continue from below.

  • Click the Add Rule... Button to open the Add Transform Claim Rule Wizard. 

      Image Removed

  • Select Send LDAP Attributes as Claims in the Claim rule template drop-down list.
  • Click Next.

      Image Removed

  • Fill the field Claim rule name with a name your choice.
  • Select Active Directory in the Attribute store drop-down list.
  • Select your appropriate LDAP Attribute in the first drop-down field from LDAP Attribute (Select or type to add more). In this example we are using the Windows login name attribute SAM-Account-Name as Name ID.
  • Select Name ID in the first drop-down field from Outgoing Claim Type (Select or type to add more).
  • Click Finish to complete the Add Transform Claim Rule Wizard.

      Image Removed

  • Check if your new rule has been added to the Edit Claim Rules dialog. Try again Step E if it has failed.
  • Click Apply to save your settings.
  • Click OK to finish.

      Image Removed

Back to Top

...

Image Removed

To continue Step 3, please go back to the plugin configuration page opened in Step1.   

Substep A: Load ADFS Metadata

The recommended way to setup the ADFS is to import ADFS Metadata. The Metadata URL from ADFS is  https://<your-adfs>/federationmetadata/2007-06/federationmetadata.xml.  

  • Click the URL radio-button and paste the Metadata URL into the field below.
  • Check Accept all if your IdP's https-certificate is not in your JIRA instance's trust store.
  • Click on Load.

      Image Removed

...

If a user logs in using SAML, he will be added to the groups specified in the User Groups section. This applies to all users. The user is assigned to these groups in addition to the groups in the SAML-response's attribute. 
The standard group in JIRA 6 is called jira-users. 
The standard group in JIRA 7 is depending on which JIRA Version you are using:

...

  • Click on show Advanced IdP Settings, find User Group in the drop down menu. 

Image Removed

  • Click Save settings to store the configuration

Image Removed

Back to Top

...

In a separate browser, open the URL https://<your-JIRA>/plugins/servlet/samlsso.

You should be authenticated by your ADFS and redirected to the JIRA Dashboard.

...

After testing, you can enable the login page redirection to finally activate the plugin. After checking the Enable SSO Redirect checkbox and clicking Save settings, requests to the JIRA login page should be redirected to the ADFS.

Image Removed

Info

If Enable SSO Redirect is enabled, you can login to JIRA manually by browsing https://<your-JIRA>/login.jsp?nosso. Use this URL if you need to login a local user unknown to the ADFS or if there are any issues with Single Sign On.

...