SAML SSO for JSM Customers using Okta as IDP

You can now allow External Customers to log in via SSO into Jira Service Management (previously Jira Service Desk or JSD). Integrate various customer portals like Atlassian Service Management and access tickets with the help of SAML SSO for JSM Customers.

Try it for free

Download and Installation

Log into your Jira instance as an admin.
Navigate to the settings and Click on Apps.
Locate SAML/OAuth SSO for JSM Customers.
Click on free trial to begin a new trial SAML/OAuth SSO for JSM Customers.
On menu bar click on Apps. Locate SAML/OAuth SSO for JSM Customers.

Step 1: Set Up Okta as Identity Provider

With the plugin installed, you can move on to setting up Okta as an IDP.

SAML Single Sign On (SSO) using Okta Identity Provider,Okta SSO Login 1.1: Okta IDP Configuration

Follow the steps provided below:

Log into Okta Admin Console.

SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login,Add New Application into Okta

For developer account, switch to Classic UI to configure app.
In the left hand menu, go to Applications → Applications and then click on Create App Integration.

Select SAML 2.0 as Sign on method and click Next.

In General Settings, enter the app name and click on Next.

SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login,Create New SAML 2.0 Application

Set up SAML parameters in the Configure SAML tab. You will find all the required information inside the SP Information tab of your plugin. The table below will help you map the right data to the fields.

Single Sign On URL	Enter ACS (Assertion Consumer Service) URL from the Service Provider info tab of the plugin.
Audience URI (SP Entity ID)	Enter SP Entity ID/Issuer from the Service Provider info (or SP Information) tab of the module.
Default Relay State	Enter Relay State from the Service Provider info tab of the module.
Name ID Format	Select EmailAddress as the Name ID Format from the dropdown list.
Application Username	Set Application Username to Okta username.

SAML Single Sign On (SSO) using Okta Identity Provider,Okta SSO Login, Attribute And Group Mapping

Next, scroll down inside the Configure SAML tab and fill out Attribute Statements and Group Attribute Statements (this step is optional).

Here’s how you can populate these fields:

a. For Name, enter "firstName" and select user.firstName from the value dropdown.

b. For Name, enter "lastName" and select user.lastName from the value dropdown.

c. For Name, enter "Email" and select user.email from the value dropdown.

d. Under Group Attribute Statements, enter "groups" for Name and select Matches regex from the Filter dropdown and enter ".*" in the adjacent textbox.

SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login, 1.2: Assigning Groups/People

After creating and configuring the app, you will be redirected to the Assignment Tab in Okta.

Here, select the people and groups that you want to be able to log in through the app. You can do this by clicking Assign and selecting Assign to People to give access to specific people.

SAML Single Sign On (SSO) using Okta Identity Provider,Okta SSO Login, Assign App to People and Groups

You can also select Assign to Groups to give access to a specific group.

Once you’re done assigning people and groups to your app, go to the Sign On tab.
Here, click on View Setup Instructions to get the SAML Login URL (Single Sign on URL), Single Logout URL, IDP Entity ID, and X.509 Certificate. You will need these to configure the Service Provider.

SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login,IDP Metadata Link

SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login, 1.3: Fetching Metadata URL

One important component you’ll require while setting up your service provider is the metadata URL of your Identity Provider.

You can follow these steps to find the metadata URL for your Okta Application:

Log into your Okta Admin Console
Navigate to Applications → [Your Application Name] → Sign On
You will find the metadata URL under the Metadata details section.

You can either leave this window open in another tab or copy and paste the URL to a note while setting up the service provider.

Step 2: Setup JSM as Service provider

Go to the Manage Apps -> click Getting started under SSO Integration with Helpdesk then click on the Add New Identity Provider.

SSO for JSM Customers using ADFS as OAuth Provider | add identity provider

Select SAML and click on the next button.

SSO for JSM Customers using ADFS as OAuth Provider | select protocol

A. By Metadata URL :

Click on Import IDP Metadata.

Enter IDP name.
Choose IDP metadata URL / File: Enter your metadata URL / File
Click Import

B. Manual Configuration :

To configure the IDP manually, you will need to have the following details from your IDP's metadata.

IDP Entity ID

Single Sign On URL

Single Logout URL

X.509 Certificate

Once you have added the IDP metadata, click on Save. If the IDP has been added successfully, Click on the Test Configuration button to test if the IDP was added successfully.

Step 3: Integrate Atlassian HelpDesk with JSM SSO

Click on the Configure API Token and configure the Service Account API token with the email.

It is necessary to have admin permissions for the service account.

After successful configuration of API token all the service desk projects with respective links will be displayed. These substituted links will be used by customers for accessing particular projects with SSO.

Copy any of the substitute links you see for your portals and try accessing it in a private browser window. You would be automatically redirected to your Identity Provider for authentication and would be allowed access to the portal only after successful authentication.

Additional Resources

Did this page help you?