SSO Implementation Issue

[Ramya Yarru]

Hello Team,

We have implemented SSO in our organization and we have our JIRA users managed using LDAP and making it as primary authentication, so for users who are member of JIRA AD group were able to login as expected but for users who were not a member of AD users on clicking the Log In option it doesn't redirect to SSO page or any other prompt but displays a message : Something went wrong which is not an appropriate message so I would want to understand why it doesn't redirect to sso or any other login screen but rather display a page saying "Something went wrong" and if it is possible to have an appropriate message to users that It is because they are not a part of Jira AD group

[Lokesh Naktode_miniOrange]

You seem to be using built-in JIRA Server/Datacenter's SSO and it looks like the users are not authorized to access the JIRA Software application but I suggest you check the logs in the "atlassian-jira.log" file located at <JIRA_HOME>/log directory for detailed error messages and troubleshoot this issue.

You can also take a look at the third-party SSO plugins from the Atlassian Marketplace which provides lots of customization where you can set different redirection rules for different types of users, easy to configure and troubleshoot any issue.

PS:- I work for miniOrange one of the top SSO vendors in the Atlassian Marketplace.

[Tom Lister]

Hi @Lokesh Naktode_miniOrange 

We are looking at setting up Crowd linked to LDAP with an  MFA plugin. How would miniOrange solution work for a similar config.

[Ramya Yarru]

Hello @Lokesh Naktode_miniOrange 

Users part of Jira AD group could login but users who are not a part of JIRA AD group receive this message rather rather than stating that they have issue with their account.

[Lokesh Naktode_miniOrange]

@Tom Lister 

We have a 2FA plugin for all the Atlassian applications but for Crowd it is still in a development phase and will be avaialble on the Atlassian marketplace soon.

Alternatively, we have a dedicated MFA solution avaialble which can be used to enable MFA on top of Crowd SSO. I suggest raising a query to miniOrange support with complete requirements and the team will get back to you with a proposed solution.

[Lokesh Naktode_miniOrange]

Hi @Ramya Yarru 

Looking at your message, It seems like an application authorization issue and we can not do anything here to update the error message because it is a generic message for all the errors. Maybe Atlassian can help you out on this.

[Tom Lister]

Hi @Ramya Yarru 

Our server is similar. Once we had implemented an SSO server, internal users were no longer able to login.

For any users not in our company LDAP , we created a second LDAP directory which we have to maintain manually when external users need access.

We will be moving to Crowd soon to create a single place to manage users.

Tom

[Ramya Yarru]

Hello @Tom Lister 

We have no external users, all of them are internal users but here the issue is users might not be aware that they have to be part of AD group inorder to access JIRA and hence if they try to login to JIRA without being a member of JIRA AD group they would be given this message which is inappropriate message as it's states there might be issue with server rather than stating that the issue is with their account.