This setup guide is a temporary version and will be updated soon. Please don't hesitate to contact us if you run into any problems.

This guide describes how to complete the initial setup for Bamboo Single Sign On Azure AD, applicable from plugin version 0.15.5. If you need any further support please feel free to contact us here.

Prerequisites

Bamboo must be accessible via HTTPS

See https://confluence.atlassian.com/bamboo/securing-bamboo-with-tomcat-using-ssl-391087422.html for instructions. This is necessary because Azure AD accepts only HTTPS-URLs for SAML endpoints.

Azure Active Directory Premium

If you already have an Azure AD account, but are not sure if your premium account is enabled

  click me to find out.

After signed in to your Azure AD account, click on Active Directory and choose the directory you want to use with SAML Single Sign On. After your chosen directory opened up, click on Licences on the right side. Then, under the Licence Plans you will see the licence type you have - Microsoft Azure Active Directory Premium, if it is enabled. Otherwise, see video provided above to enable it.


If your Azure premium account  is not yet enabled, find out how to enable Azure Active Directory Premium trial here


Installation Procedure


Step 1: Install the plugin  

  • Click Add-ons under Bamboo Administration on the top right corner of your Bamboo interface. Then, choose Find new add-ons and you will be taken to Atlassian Marketplace. Search for SAML SSO and click on Free Trial to install. 



  • After installation succeeded, click on Manage, then choose Configure. Now, you are on the plugin configuration page. 




Back to Top

Step 2: Setup the Azure AD  

Step 2 will be completed in Azure AD. 

Substep A : Select your directory and start application dialog

  • Go to https://manage.windowsazure.com and login with your credentials.
  • Select Active Directory on the left navigation panel, and select the directory that you want to use with SAML Single Sign On.

 

      

  • Click on APPLICATIONS, then click on ADD to start a new application dialogue















Substep B: Add a new application

  • Click on Add an application from the gallery.
  • Select Custom on the left navigation panel, and click Add an unlisted application my organization is using.
  • Then, fill in a name of your choice, e.g.. SAML Single Sign On in the NAME field.
  • Click on the Finish button at the bottom to add the application to your directory.

Back to Top

Substep C: Configure the new application

  • Click on Configure Single Sign On. In the Pop-up window choose select Microsoft Azure AD Single Sign-On, then click on Next.




  • Click on Download Metadata (XML) to download the FederationMetadata.xml. We will configure the SAML Single Sign On with the Metadata from Azure AD in Step F.
  • Check the Checkbox Confirm that you have configured... .
  • Click on Next.



  • Fill in a NOTIFICATION E-MAIL for which you want to get notifications for this application.
  • Click Finish to complete the application configuration. Then you come back to the overview page of SAML Single Sign On and continue with Substep D to grant user access. 


Substep D: Grant access to users

  • Click on USERS AND GROUPS and select All Users in the SHOW drop down field. Then click on the tick on the right side to show all users. 
  • Select the user which you want to grant access for this application, and click on ASSIGN at the bottom.
  • Then, click on YES  at the bottom of the black pop-up window to confirm to enable access for selected users.


  • Finally, review “Access” status to see if the user has been successfully granted access to application now.

Step 3: Configure the Plugin  

  • To continue Step 3, please go back to the plugin configuration page opened in Step 1.  

Substep A: Load Azure AD Metadata

The recommended way to setup the Azure AD on the SAML Single Sign On is to import the Azure AD Metadata.

  • Select load from XML and paste in the content from the FederationMetadata.xml (downloaded in Step2 Substep C) into the field below.
  • Click on Load to load the Azure AD configurations into the plugin.


Unlike SAML SingleSignOn for JIRA, Confluence and Bitbucket, SAML SingleSignOn for Bamboo is currently not able to create and update users or assign groups on login. This functionality will be eventually added in a future release.


Back to Top

Step 4: Test 

In a separate browser, open the URL https://<your-bamboo>/plugins/servlet/samlsso.

You should be authenticated by your Azure AD and redirected to the Bamboo Dashboard.

Step 5: Enable login redirection 

After testing, you can enable the login page redirection to finally activate the plugin. After checking the Enable SSO Redirect checkbox and clicking Save settings, requests to the Bamboo login page should be redirected to the Azure AD.


If Enable SSO Redirect is enabled, you can login to Bamboo manually by browsing https://<your-bamboo>/userlogin!doDefault.action?nosso (in Bamboo 5: https://<your-bamboo>/userlogin!default.action?nosso). Use this URL if you need to login a local user unknown to the Azure AD or if there are any issues with Single Sign On.

Back to Top

You might also find following documentation helpful: