Goal

After completing this guide, you will have set up Azure and your ALB for the AWS ALB & Amazon Cognito Authentication app.

Prerequisites

This guide assumes the following:

• A (trial) subscription for the AWS ALB Auth app

• Admin access to your Atlassian product and AWS

Guide

1. Go to https://portal.azure.com, then to Azure Active Directory and choose App registrations.
   

   

   
   
   

2. Then click New Registration
   
   
   

3. Enter a name for the app. Now, add the Redirect URI https://<baseUrl>/oauth2/idpresponse and substitute <baseUrl> with the baseUrl of your instance.
   

   

   
   
   

4. Copy the Directory (tenant) ID, as well as the Application (client) ID into your favorite text editor. We will need it later.
   

   

   
   
   

5. Now go to Certificates & secrets and click New client secret.
   

   

   
   
   

6. Add a Description for the secret and an Expiry. If you do not want to interrupt your service, choose Never and click Add. 
   

   

   
   
   

7. Now, the secret will be displayed once. Thus, click the copy button near the Value column and add this to your text editor as well.
   

   

   
   
   

8. Next, click Token configuration and then Add optional claim.
   

   

   
   
   

9. For the type choose Access - for some reason, the ALB will ignore ID tokens. For this tutorial series, we assume that you use the user principal name for the username in your Atlassian application. Thus, click upn from the list and confirm by clicking Add.
   

   

   
   
   

10. Azure will now ask you to add permissions to retrieve the claims from before. Select Turn on the Microsoft Graph ... option and click Add.
    

    

    
    
    

11. For the next steps, go to the AWS management console at https://console.aws.amazon.com/ and go to the Load balancers options.
    
    Select the load balancer which manages your Atlassian product, go to Listeners and click View/edit rules for the listener.
    

    

    
    
    

12. On the rules page, click the edit tab. Next, search for the rule of your Atlassian product and select the edit icon.
    

    

    
    
    
    

13. Select Add action and choose Authenticate.
    

    

    
    
    

14. Next, choose OIDC for the type of the authentication.
    

    

    
    
    

15. Now we need to add the urls. You need the Directory Tenant ID, and Application Client ID, as well as the secret.

    

16. Next, expand Advanced settings and set the scope to "openid profile". (Without quotes. The space between the two words is important!!). Click the checkmark button.
    Don't forget to select the load balancer below under Forward to
    

    

    
    
    

17. For the last step, click Update to save your settings. Please note that it will take some seconds until this will be enforced.
    

    

Further configuration

Please see (3.0.x) User Provisioning to learn about user provisioning, e.g. by claims or with an identity provider