How do you auto-populate confluence-users-<sitename> and jira-users-<sitename>?

[Harold Price]

Okta and other IdPs have tools to keep group memberships dynamically up-to-date. However, there is no way to populate the confluence-users and/or confluence-users-<sitename>, jira-users-<sitename> groups based on their membership in groups in pushed Okta groups.

I can assign product access based on groups in Okta. However, is it better to use the built-in groups in Atlassian access to grant users to products and the the correct confluence and jira groups?

We have created a group called "Atlassian Confluence Users" and "Atlassian Jira Users" in Okta and are pushing that to Atlassian Cloud. How can these groups be mirrored to their respective Atlassian built-in groups?

[Paul O'Shaughnessy · Accepted solution]

I ran into this problem a few years back.  These days you might be able to automate something to sync group membership, but we took the approach of moving to the IDP managed groups. 

If you still have the existing 'confluence-users' group and group members you could do something similar to what we did which meant slowly moving across over a longish period of time.  I can't believe there isn't a better solution to this, but I've never actually seen one published.  On the plus side, this approach is fairly easily and low maintenance.

See my very old post on this. 

[Harold Price]

Paul, thank you for your response as well. Your solution sounds promising. Unfortunately, I can not access the link you provided.   Any chance you can fix that?

Thanks again,

Harold

[Paul O'Shaughnessy]

I think the link is fixed now!

[Harold Price]

Thank you Paul. Your assessment is inline with what Kazuki also explained.

Hopefully, Atlassian can add some better group management controls into the Atlassian  Access product.

[Kaz Nobutani · Accepted solution]

Hello Harold,

Thank you for posting your question. 

I personally recommend you to use the pushed Okta group to manage accesses of products, simply because you do not need to manually + individually add users to each <product>-<access>-<sitename> group. By assigning accesses to the pushed group, newly synced users will automatically will have the same access as other users in the same group, which makes user management easy. 

Or do you have any requirements to use the <product>-<access>-<sitename> groups?

Also, as far as I know, there is no option to copy or sync the product access from one to another on the UI. 

[Harold Price]

Kazuki,

Thank you for your response. This is less of a product access and more of a space permissions issue. We have over a hundred spaces with permissions set to "confluence-users" on the previous confluence Server that we are migrating to the cloud which now requires the confluence-users-<sitename>.  Not only can I not automatically grant all new accounts to this group, but now I can not grant to the "confluence-users-<sitename>" group either.

Do I now have to manually update the hundreds of spaces and monitor daily any new space being created so that everyone is given access to that new space using the Okta group instead of the default confluence-users-sitename group.

Is there a way to setup my okta group as the default group for spaces ?

[Harold Price]

@Kaz Nobutani 

Please pass this along to the rest of the Atlassian team:

• Have the ability to set a Default group for users provisioned from SCIM
  or
• Allow groups to be dynamically generated from a set of user attribute criteria or other groups they do or don't belong to.

Thanks again for the assistance.

[Kaz Nobutani]

Hello Harold,

Thank you very much for your feedback. I researched on existing feature requests and spotted these ones. The idea is that to have a default groups for imported users; automatically assign/map them which is what you stated above.

https://jira.atlassian.com/browse/ACCESS-604 (Grant users synced from identity providers via SCIM application access by default)

https://jira.atlassian.com/browse/ACCESS-1397 (Sync group membership from local default group to synced group)

Please feel free to leave comments and vote for those items. I’m afraid the workaround would be to manually assign permissions little by little as Paul shared at this point. 

Here is more information about feature requests in general.

[Harold Price]

That was extremely helpful. I added some votes.  The components should include more than just Google GSuite on #604

Thank you very much.   Have a great day

[Kieren _SmolSoftware_]

Hi @Harold Price  ,

This has been an issue for a while and unfortunately as @Kaz Nobutani said there is no feature within Atlassian administration that will solve this for you. It has been a big pain point for Atlassian Admins who want to utilise the default or custom Atlassian groups for both SCIM and non-SCIM users, ACCESS-604 is a testament to that!

There is an upcoming app that could help with this, we're going to solve ACCESS-604. It's about to be released in a free closed beta (mid Dec 2023). If you're interested check out our website https://smolsoftware.com and drop us a line. When we launch publicly, I'll drop a note back in here. 

-Kieren
Co-Founder @ Smol Software | Ex-Atlassian

[Harold Price]

@Kieren _SmolSoftware_ thanks for the response. I'll check out your app.

[Kieren _SmolSoftware_]

@Harold Price we've just launched. Hopefully it will solve your issue.

https://marketplace.atlassian.com/1234013

-Kieren
Co-Founder @ Smol Software | Ex-Atlassian