Note: This Page is no longer actualised. For more updated information please see below:
- To configure Atlassian JIRA and ADFS via SAML Single Sign On (SSO) use:
Setup SAML SSO with ADFS (JIRA) 0.14.X - 0.14.4 and Setup SAML SSO with ADFS (JIRA) - 0.14.5 (newer).
- To configure Atlassian Confluence and ADFS via SAML Single Sign On (SSO) use:
Setup SAML SSO with ADFS (Confluence) - 0.14.X - 0.14.4 and Setup SAML SSO with ADFS (Confluence) - 0.14.5 (newer).
It’s also possible to connect Atlassian JIRA and Confluence with Azure AD or GSuite, check the setup guides below, and start your 90 days free trial.
- View Setup Guides for JIRA SAML SSO and try it out here.
- View Setup Guides for Confluence SAML SSO and try it out here.
This article describes the ADFS configuration necessary for SAML Single Sign On to work.
- ADFS 2.0 / 3.0
- Jira/Confluence must be accessible via HTTPS. See https://confluence.atlassian.com/display/DOC/Running+Confluence+Over+SSL+or+HTTPS for instructions.
This is necessary because ADFS accepts only HTTPS-URLs for SAML endpoints.
Configure ADFS for JIRA/Confluence single sign on
Open the AD FS 2.0 Management Console and select Add Relying Party Trust to start the Add Relying Party Trust Wizard and click Start.
Select Enter date about the relying party manually and click Next.
Specify a display name of your choice and click Next.
Select AD FS 2.0 profile and click Next.
Just click Next on the Configure Certificate Page.
Select Enable support for the SAML 2.0 WebSSO protocol and configure the URL to the SAML plugin URL as Relying party SAML 2.0 SSO service URL.
This URL has the format
So if your Confluence (or Jira) is running at https://confluence.yourcompany.com/ the URL is/servlet/samlsso
Enter the same URL as Relying party trust identifier and click Add to add it to the list. Click Next.
Select Permit all users to access the relying party and click Next.
Just click Next on the next page, tick Open the Edit Claim Rules dialog and click Close.
The Edit Claim Rules Window opens. I the first tab, click Add Rule
Select Send LDAP Attributes as Claims and click Next.
Enter a name of your choice for the rule. Select Active Directory as Attribute store. Select the LDAP Attribute containing the Confluence/JIRA userid and Name ID as Outgoing Claim Type. Click Finish.
Click OK to save the settings.
Export the ADFS token signing certificate
The SAML response coming from ADFS is signed to insure that the authentication is coming from the correct Identity Provider. To validate this signature, the certificate has to be exported from ADFS and configured in the plugin configuration.
In the ADFS management console, click the Certificates folder and double-click on the Token Signing certificate.
Click the Details tab and the Button Copy To File.
Export the certificate as Base-64 encoded X.509 (.CER).
Open the exported file in a text editor and copy the content into the clipboard for the next step.
Configure the plugin
Open the SAMLSSO plugin configuration at
or by clicking Configure in the Plugin Manager.
Enter the appropriate settings and click Send.
|IdP URL||URL on ADFS where the SAML authentication requests are sent to, usually
|Default redirect URL||
Relative URL on JIRA or Confluence to redirect to after successful login if no specific URL was called. This is usually the case if the samlsso-Servlet is opened directly.
This value is usually just
|Login page URL||If the SAML login fails, a link to the username/password login page is displayed in the error page. For Confluence, this is usually
|Redirect login requests||If this box is checked, JIRA/Confluence redirects to the samlsso-Servlet (which redirects to ADFS) instead of the login page. If this is box is not checked, single sign on only works if the samlsso-Servlet is called directly at
Paste the BASE64-encoded Token Signing Certificate here.
After clicking Send, the certificate is shown in the field below in readable form.