Atlassian Access & Azure AD SSO / Provisioning with different UPN Name & E-Mail Adress not possible?

[Constantin Lotz]

Hi there,

i've an azure ad tenant withe the following user layout:

User principle Name = ShortName@internal-domain.de
E-Mail Adress = Surname.Lastname@external-domain.de

So our logon name at M365 is always the upnname (ShortName@internal-domain.de).

We've setup the SSO Connection, authentication works within Atlassion. When entering ShortName@interna-domain.de as username we'll be redirected to M365 login. But the user mapping is not correct.

Within Atlassion the User will be created with the upnname and the same value will be the e-mail address value. But I expect the real E-Mail Address to be that value which is the user.mail Attribute within Azure.

I think the problem is, that atlassian only handles the e-mail adress as uniqued identifier, right? But we would like to have the same logon names for all systems, and the email adress must be different that way.

When i simply switch the Unique User Identifier mapping value to user.mail I'm not able to get a correct redirect to M365 when trying to login with Surname.Lastname@external-domain.de

Anyone else with those problems?

Kind regards,

Constantin

[Ed Letifov _TechTime - New Zealand_ · Accepted solution]

Hello, @Constantin Lotz 

1) Yes, Atlassian keys everything by email. To be precise – regardless of what is specified in the mapping, i.e. one would think that as per your screenshot the unique identifier is the UPN, but no it's completely ignored, and it's the email that is being used to identify the user.

2) With the configuration in your screenshot the users should be created with emails from the external domains, despite them entering the UPN to trigger the redirect, and logging into Azure with UPN.

Is this not working?

With configuration as per your screenshot, this statement is not correct:

Within Atlassion the User will be created with the upnname and the same value will be the e-mail address value.

3) The triggering to SAML flow happens based on the claimed domains. For you to be able to enter the email with the external domain and be redirected – you need to claim that domain too in Atlassian.

What you then use to actually login into Azure is irrelevant – as soon as you are authenticated the attributes will be sent as per the mapping in your screenshot. If you claim both domains – users will be able to enter either UPN or the email at Atlassian front-door.

[Constantin Lotz]

Ok thanks a lot, i guess it was the thing that we have to claim both domains :-)