Service Desk Clients who are also in AD

[Tamara Schacham]

Some of our clients are set up in our AD in order to access Confluence.  When those same users try to set up Jira Service Management accounts, they are not able to set their passwords because they are recognized by Jira as AD users.  

Is there a way to work around this?

[Brant Schroeder · Accepted solution]

@Tamara Schacham The workaround would be to use a different email address or educate those users that they already have an account in JSD.  Unfortunately, once their account is created in the user directory you are using Jira will recognize it there and not allow them to create another account.

[Tamara Schacham]

Hi Brant,

Thanks for your response.

I'm wondering whether it might work better if we add the user to Service Management first and then to AD once he is set up.

I'll experiment a bit and report back.

[Brant Schroeder]

@Tamara Schacham For the AD account users are they able to access JSD customer portal if they just use their AD credentials?  Are you set up for anyone to access or do they have to be a customer?  Since the account is setup they should be able to login if the JSD settings allow it.

[Tamara Schacham]

It looks like clients will be able to sign in to Service Desk with their AD credentials, so we can skip the email step.  We will need to manually remove the Jira Software licence that they are assigned automatically when they log in for the first time. Assignment to an organization will also need to be done manually, I assume. 

[Brant Schroeder]

Yes that is correct.

[Tamara Schacham]

Hi @Brant Schroeder 

As it turns out when our AD users try to access JSD, they get the following error.

Do you have any other suggestions?

[Brant Schroeder]

Do these AD users have access as customers to the service desk or is your service desk available to everyone?  https://support.atlassian.com/jira-service-management-cloud/docs/change-project-customer-permissions/

[Tamara Schacham]

We have the following setup:

I'm thinking that we could change "Who can raise requests?" to "Customers who have an account on this site", but I'm worried about side effects.  We will still want to be able to add customers to the project who aren't in our AD by email invitation as we do now. 

Also, I tried this change out on our test instance but found that neither the AD user nor the non-AD user that I added by invitation could see other tickets belonging to the organization unless it was explicitly shared with their Id.  I'm not sure if this is related to the configuration change.