SAML Authentication: Is it possible to use another IdP than the officially supported ones?

[Florian Riesen]

Is it possible to use a self-hosted IdP in order to authenticate a cloud instance of jira via SAML?

We would like to use the Cloud instance but authenticate with an IdP on premise. So we do not want to use one of the oficially supported ones:
Microsoft Azure, OneLogin, Okta, and Bitium.

[somethingblue]

Hi Florian,

You definitely can use a self-hosted IdP to authenticate to Cloud, however, we only have instructions for the ones that are supported by Atlassian:

Atlassian supports OneLogin, Okta, and Azure, but you can use other IdPs that Atlassian doesn't support if you have another IdP. If you use an on-premise IdP, users will only be able to authenticate if they have access to the IdP (i.e. from your internal network or a VPN connection).

If you don't have instructions for your IdP:

1. Add the Atlassian application to your IdP
   
   
2. Copy details from your IdP to you Atlassian site
   
   
3. Copy details from your Atlassian site to your IdP
   
   
4. Test SAML for your Atlassian site

One thing to keep in mind if you're using an unsupported IdP: Make sure that your IdP can send email using the NameId attribute.  There are specific mappings you'll want to use in your IDP and you can find that information in the SAML single sign-on knowledge base article under Add the Atlassian application to your IdP > If you're using an unsupported IdP.

Thanks,

Branden