In your Atlassian product, open the in-product marketplace as described in the Atlassian documentation.
Search for "resolution saml" and click "Install" for SAML Single Sign On (SSO) by resolution Reichert Network Solutions GmbH.


After the installation is complete, click Manage Apps/Addons. 

Configuration in the Keycloak Web Console

Login to your Keycloak instance with administrator privileges and enter the Administration Console

Select the realm of the users who should be synchronized and click on Clients in the left-hand navigation bar.
Click on the Create client button of the client view to register a new client for the User & Group Sync connector

Provide a name for the Client ID and make sure that the Client type is OpenID Connect and click on Next.

In the Capability config tab, enable both the Client authentication and Authorization options, and have the other options as the following screenshot, then click on Next:

Keep the settings in the next tab as is, and click on Save.

Switch to the Service account roles tab and click on the Assign role button.

Select "Filter by clients" and search for "manage-users" then click enter. Choose "realm-management / manage-users" and click on Assign.

The settings should look like the below now:

Go to the Credentials tab, and copy the Client secret. You may regenerate it any time. 

Configuration in User & Group Sync Configuration page

Navigate to the administration console for Jira, Confluence, or Bitbucket 

Confluence: search for USERS & SECURITY under which you'll find User & Group Sync
Jira: navigate to the User management tab in which you'll find User & Group Sync
Bitbucket: navigate to Administration/ Accounts you'll find User & Group Sync listed here

Click on Add Connector and choose Keyloak Connector.

Set a name, insert your Keycloak URL appending /auth at the end, and provide

• realm name

• client-id

• secret

as per your Keycloak setup earlier. Use the Save and Test Connection button to check if User Sync can connect to Keycloak successfully.

To schedule a periodic synchronization of your Keycloak directory with User & Group Sync, click on Show Advanced Settings at the very bottom of the page.
Enable Scheduled Synchronization needs to be checked, the default cron expression would then cause a sync every day at 2 am.

Click Save and Return to finish the configuration.

For the next steps, please go to Manage apps (or addons), choose SAML SSO and click Configure.

First Steps - Wizard

After you clicked "Configure", the Wizard will be triggered. If not, or if you want to add another Identity Prover (IdP) to your existing configuration, click on "+ Add IdP". This guide assumes, that there is no IdP configured.
The Wizard greets you with information, click on "Add new IdP" to proceed.

welcome_wizard_add_newidp

Select Keycloak for your identity provider and select OpenID Connect for the authentication protocol. Enter a unique name and click Next to continue. 

Go to your Keycloak server and choose your realm. Then go to Clients and click Create.

Enter a Client ID. That must be unique. Click Save to continue.

Next, scroll down and choose confidential for the Access Type. For the Valid Redirect URIs enter the callback URL from before.

Next, click Save and reload the page. Without reloading, the options for the next step is not displayed!

After reloading the page, go to the Credentials tab. Without reloading, the tab is not displayed!

Copy the secret to your favorite text editor, we will need it soon.

Enter your Keycloak Base Url and Keycloak Realm, next click Generate Metadata Url.

Click Import Metadata.

You will see this message if the import was successful.

To finish the wizard, click Save and Close.

To test you configuration, go to the System & Support section of the app and scroll down to the Tracker List.

Click New Tracker. If you have more than one identity provider configured, you must choose which configuration should be used for the log in test.


Copy the test url and open the link an incognito web browser. If something goes wrong during the test, you can easily create a support ticket that includes this tracker by click Contact Support. Additionally, you can contact us by going to https://www.resolution.de/go/support or booking a free meeting via https://www.resolution.de/go/calendly.

Redirect to SSO

After a successful test, the next step is to configure the redirection. With the redirection setting, the app can automatically redirect users to log in via OpenID Connect.

Go change this setting, go to Redirection from the middle panel.

By checking Enable SSO Redirect, users will get redirected to the configured SSO provider for login. If you are running JSM, you find a second option below. 

Click Save to finish the configuration