Linking Portal-Only Accounts to Okta with Custom Username for MFA

[Andrew]

Hi all,

We’re trying to link our Jira Service Management portal-only accounts to Okta in order to enforce Okta’s MFA. However, we’ve run into an issue due to how our Okta setup was originally configured.

Years ago, Okta was set up to use a custom username for users (not their email address). Now, when attempting to link portal accounts to Okta, Okta expects a username as the identifier, which doesn’t match our Atlassian email addresses. This has been confirmed by Okta support.

Questions:

1. Is there a way to add a custom field to portal-only users that can be passed as part of the login request to Okta (e.g., the custom username instead of email)?
2. Does the new SCIM provisioning support mapping or syncing this kind of custom identifier to Okta?
3. Has anyone successfully implemented MFA for portal-only users using a non-email identifier with Okta?

Any guidance or examples would be greatly appreciated!

Thanks,
Andrew

[Andrew]

Thank you @Marc - Devoteam , yes we tried that and discovered Okta required the 'Okta account username' rather the email address (even though there is a field in Okta you should be able to set this)

[Marc - Devoteam]

Hi @Andrew 

No this can't be done.

Also the SCIM provisioning of from okta to Atlassian and not the other way around.

You could setup Okta as an IDP for Atlassian customers, see https://support.atlassian.com/provisioning-users/docs/add-identity-providers-to-connect-portal-only-customers/ 

[Marc - Devoteam]

Hi @Andrew 

Maybe this can be set in Okta, but Atlassian only works with email addresses, as user are able to set a different public user name.