SSO stopped working - Azure AD + Atlassian Cloud

[Chris Shaffer]

Yesterday, our SSO functionality suddenly stopped working. We've made no changes to our organization or in the Azure AD plugin for Atlassian Cloud.

We can't sign on using our MS accounts; we had to do a password reset and use a localized account. This effectively locked out all our admin accounts as they do not have actual email addresses (we're working to solve this now so we can eventually login and at least disable SSO for now).

There isn't anyway to open a support issue about this since none of us can currently login as an admin user and the Jira system won't allow us to raise a support request with our restricted users.

There's no way to open a support issue w/the Atlassian Cloud plugin because it only allows you to select a few options completely unrelated to our issue (Security is the only option) and it's so buggy half the time that option doesn't appear. I haven't been able to successfully submit this through the Azure portal, but I suspect this issue isn't on Azure's end anyway.

What happened?

[Chris Shaffer · Accepted solution]

For the record, what happened was that our trial expired.

Apparently, Atlassian chose to make the billing of Access separate from things like Jira, Confluence and plugins so you have to add a payment method explicitly for Access.

This is an asinine decision in my opinion which is not apparent when you activate the product.

Why the existing payment method for other Atlassian products wouldn't be used by default, I have no idea.

[Lokesh Naktode_miniOrange]

@Chris Shaffer 

It seems you are using Atlassian access to enable SAML SSO from Azure AD. 

Azure AD has a signing key rollover process where keys rollover on a periodic basis and, in an emergency, could be rolled over immediately. 

You can read more about this here.

https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-signing-key-rollover

I suggest you get the updated X.509 certificate from Azure AD federation metadata and update it on Atlassian Access and try again.

I hope this resolves the issue.

[Chris Shaffer]

I'll take a look at that.

I believe you meant to link here, though:  https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-certificates-for-federated-single-sign-on

[Lokesh Naktode_miniOrange]

You will see there an APP Federation metadata URL. You will find an updated X.509 certificate there. Update it on the Atlassian access SSO configuration and try again.

[Chris Shaffer]

Yeah, I'll try that. But again, at the moment, the user I need to login with can't login. I'm waiting on a mailbox to be created so that user can get email (see my original post).

Is this something that we're going to have to keep doing periodically?

[Lokesh Naktode_miniOrange]

No Sure as I don't have experience with Atlassian Access and whether it has the capability to update the X.509 certificate automatically.

I work in the IAM and SSO domain and looking at your post  I thought this could be one of reason as you did not change anything either on Atlassian or in Azure AD.

[Chris Shaffer]

Okay, well thanks for the assist. I'll post back once I know if it works.