SAML SSO for JSM Customers using Shibboleth3 as IDP

You can now allow External Customers to login into Jira Service Management (previously Jira Service Desk or JSD) via SSO! Integration with various customer portals like Atlassian Service Management and access tickets with the help of SAML SSO for JSM Customers.

Download And Installation

  • Log into your Jira instance as an admin.
  • Navigate to the settings and Click on Apps.
  • Locate SAML SSO for JSM Customers.
  • Click on free trial to begin a new trial SAML SSO for JSM Customers.
  • On menu bar click on Apps. Locate SAML SSO for JSM Customers .

Step 1: Setup Shibboleth3 as Identity Provider

      • In conf/, uncomment and set 'idp.encryption.optional' to true.
           eg. idp.encryption.optional = true
      • In conf/metadata-providers.xml, configure Service Provider like below.
      • <MetadataProvider xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata"
          id="miniOrangeInLineEntity" xsi:type="InlineMetadataProvider" sortKey="1">
          <samlmd:EntityDescriptor ID="entity" entityID="<SP-EntityID / Issuer from Service Provider Info tab in plugin.>"
            <samlmd:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
            <samlmd:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="<ACS (AssertionConsumerService) URL from Step1 of the plugin under Identity Provider Tab.>"
              index="1" />

      • In conf/, uncomment and set default NameID as Email Address like this
      • idp.nameid.saml2.default=urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

      • In conf/saml-nameid-xml, search for shibboleth.SAML2NameIDGenerators. Uncomment the shibboleth.SAML2AttributeSourcedGenerator bean and comment all other ref beans.
      • <!-- SAML 2 NameID Generation -->
        <util:list id="shibboleth.SAML2NameIDGenerators">
          <!--<ref bean="shibboleth.SAML2TransientGenerator" /> -->
          <!-->ref bean="shibboleth.SAML2PersistentGenerator" /> -->
          <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
          p:attributeSourceIds="#{ {'email'} }" />

      • Make sure you have defined AttributeDefinition in conf/attribute-resolver.xml.
      • <!-- Note: AttributeDefinitionid must be same as what you provided in attributeSourceIds in conf/saml-nameid.xml -->
        <resolver:AttributeDefinitionxsi:type="ad:Simple" id="email" sourceAttributeID="mail">
          <resolver:Dependency ref="ldapConnector" />
          <resolver:AttributeEncoderxsi:type="enc:SAML2String" name="email" friendlyName="email" />
        </resolver:AttributeDefinition >

        <resolver:DataConnector id="ldapConnector" xsi:type="dc:LDAPDirectory" ldapURL="%{idp.authn.LDAP.ldapURL}"
          baseDN="%{idp.authn.LDAP.baseDN}" principal="%{idp.authn.LDAP.bindDN}"
            <!-- Define you User Search Filter here -->
            <![CDATA[ (&(objectclass=*)(cn=$requestContext.principalName)) ]]>


      • Make sure you have AttributeFilterPolicy defined in conf/attribute-filter.xml.
      • <afp:AttributeFilterPolicy id="ldapAttributes">

      • Restart the Shibboleth server.
      • You need to configure these endpoints in the miniOrange plugin.
      • IDP Entity ID https://<your_domain>/idp/shibboleth
        Single Login URL https://<your_domain>/idp/profile/SAML2/Redirect/SSO
        Single Logout URL https://<your_domain>/idp/shibboleth
        X.509 Certificate The public key certificate of your Shibboleth server

Step 2. Setup JSM as Service provider

A. By Metadata URL :

  • Click on Import from Metadata tab.
  • Enter IDP name.
  • Enter IDP metadata URL: Enter your metadata URL
  • Click Import
  • SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login,IDP Metadata Link
B. Manual Configuration :

To configure the IDP manually, you will need to have the following details from your IDP's metadata.

  • IDP Entity ID
  • Single Sign On URL
  • Single Logout URL
  • X.509 Certificate
SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login,IDP Metadata Link

Once you have added the IDP metadata, click on Save. If the IDP has been added successfully, Click on the Test Configuration button to test if the IDP was added successfully.

Step 3: Integrate Atlassian HelpDesk with JSM SSO

  • Click on the Configure API Token and configure the Service Account API token with the email.
  • It is necessary to have admin permissions for the service account.
    SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login,IDP Metadata Link
  • After successful configuration of API token all the service desk projects with respective links will be displayed. These substituted links will be used by customers for accessing particular projects with SSO.
  • SAML Single Sign On (SSO) using Okta Identity Provider, Okta SSO Login,IDP Metadata Link
  • Copy any of the substitute links you see for your portals and try accessing it in a private browser window. You would be automatically redirected to your Identity Provider for authentication and would be allowed access to the portal only after successful authentication.

miniorange img  Hi! Do you need help with this guide?

 Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again

Sync product to woocommerce store from Amrod

Recommended Add-Ons

Free Trial

If you don't find what you are looking for, please contact us at or raise a support ticket here.