!!! We have migrated this cloud instance to our own hosted server instance !!!

Please follow this link to find the content you are looking for: Admin password prompt (WebSudo)

Thank you for your understanding.

Problem

We've noticed that if we log in using SSO with a jira/confluence-administrator user, when we try to go to an administration page, we are prompted to re-enter the user password. Why the SAML Single Sign On plugin does not perform the authentication process ?

Solution

The WebSudo component does not use the SAML SSO Plugin for authentication. You essentially have two options.

You login/create a normal administrator account with a JIRA/Confluence password and use him to access the administration section.
Disable WebSudo: https://confluence.atlassian.com/jira/configuring-secure-administrator-sessions-231343939.html#ConfiguringSecureAdministratorSessions-DisablingSecureAdministratorSessions

A little more background:

There isn’t a good Way to implement SSO with WebSudo. Lets assume we could have WebSudo do single sign on … what would happen then is:

You login to Confluence/Jira via SSO so entering your Username & Password at the IdP (if you weren’t already authenticated there).
Once you want to become admin, WebSudo would send you to the IdP for authentication.
The IdP sees you are already authenticated and sends you back to Jira/Confluence as AUTHENTICATED, WITHOUT asking you for the password again.
Here you go you are in the admin section.

Both from a Usability & Security perspective this is actually pretty much the same as having turned off the password prompt.

To out knowledge there is no Way via SAML Protocol to force the IdP to ask for the Password again – since our plugin can’t know the password (that would defeat the whole SAML Security architecture) we have no other Way than sending the request to the IdP.

SAML Single Sign On

Admin password prompt (WebSudo)