Follow the Step-by-Step Guide for Bitbucket Single Sign On (SSO) using Azure AD as IdP

STEP 1: Configuring Azure AD as IdP

• In Azure AD, click on Add Relying Party Trust . Then click on Start .
• In Select Data Source: Select Import data about the Relying Party published online or on a local network and enter the metadata URL provided in the Configure IDP tab of the plugin. Click Next .



• In Specify Display name: Enter Display name . Click Next.
• In Configure Multi-factor Authentication Now, select I do not want to configure multi factor authentication settings for this relying party trust. Click Next.
• In Choose Issuance Authorization Rules, select Permit all users to access this relying party. Click Next.
• In Ready to Add Trusts, select click Next.
• Check Open the Edit Claim Rules dialog and click close. Click Add rule and then select Send LDAP Attributes as Claims . Enter the following:
  
  

  Claim rule name	Attributes
  Attribute Store	Active Directory
  Outgoing Claim Type	Name ID

• Click on Finish.

STEP 2: Configuring Bitbucket as SP

• In miniOrange SAML plugin, go to Configure IDP Tab. Enter the following values:
  
  

  IDP Entity ID	http://<your_Aure ADdomain>/Azure AD/services/trust
  Single Sign On URL	https://<your_Azure AD_domain>/Azure AD/ls
  Single Logout URL	https://<your_Azure AD_domain>/Azure AD/ls
  X.509 Certificate	Paste the certificate value you copied from the Azure AD Metadata file.

• In miniOrange SAML plugin, go to User Profile tab. Enter the following values:
  
  

  Username	Name of the username attribute from IDP (Keep Username as NameID by default)
  Email	Name of the email attribute from IDP (Keep Email as NameID by default)
  Full Name Attribute	Name of the firstname attribute from IDP and Name of the lastname attribute from IDP

  OR
  

  Username	Name of the username attribute from IDP (Keep Username as NameID by default)
  Email	Name of the email attribute from IDP (Keep Email as NameID by default)
  FirstName	Name of the firstname attribute from IDP
  LastName	Name of the lastname attribute from IDP




• Go to User Groups tab. Enter the following values:
  
  

  Group Attribute

  Name of the Role attribute from IDP

• You can check the Test Configuration Results to get a better idea of which values to map here.
• Under the Group Attribute Section, configure which GROUP value coming in the SAML response needs to be mapped to which role. The Group value coming in the SAML response will be mapped to the Group assigned here and the user will be assigned that role.




• Go to SSO Settings tab. Enable Auto-redirect to IDP and Disable Bitbucket login option. Copy the URLs for backup.