Contents

User and Group Sync for Keycloak

The User & Group Sync app syncs user and group information from Keycloak to Jira, Confluence, and Bitbucket. Syncing user group attributes will sync user details such as groups, users, and directories. Sync can be performed manually or scheduled to run after set time intervals. By doing so, the administrator only has to manage user accounts in Keycloak. As a result, Atlassian modules such as Jira, Confluence, and Bitbucket require less admin time to create users and groups.

Download And Installation

Log into your atlassian instance as admin.
Navigate to the settings menu and Click Manage Apps.
Click on Find new apps .
Locate miniOrange User and Group Sync app.
Click Try free to begin a new trial or Buy now to purchase a license.
Enter your information and click Generate license when redirected to MyAtlassian.
Click Apply license.

Step 1: Setup Keycloak

User and Group Provisioning in Jira using Keycloak | Keycloak Admin Login

From the sidebar navigate to clients, and click on create client button to create a new client/ application.

User and Group Provisioning in Jira using Keycloak | Clients Section

Now under General Settings make sure you set the client type as OpenID Connect and also give a Client ID, and click on next.

User and Group Provisioning in Jira using Keycloak | Client General Settings

Inside the capability config section, make sure to toggle on the Client Authentication and Authorization toggles and click Next.

User and Group Provisioning in Jira using Keycloak | Client Capability Config

After landing on the Login Settings, provide the required URL values in which a valid redirect URL should contain the value of your Jira Base URL and click on save.

User and Group Provisioning in Jira using Keycloak | Client Login Settings

After saving the client configuration navigate to the credentials tab and save the client secret to configure the application.

User and Group Provisioning in Jira using Keycloak | Client Secret

Navigate to the Realm roles section from the sidebar, and select uma_authorization role.

User and Group Provisioning in Jira using Keycloak | Realm Roles

Move to the associated roles tab and click on Assign roles.
Assign the required roles from the available roles.
for Ex: query-users, manage-users, manage-realm, query-groups, query-realms, etc;.

User and Group Provisioning in Jira using Keycloak | Assign Roles

You have now successfully configured Keycloak and using Client Secret and Keycloak Base URL configure User & Group Sync App

Step 2: Setup User Sync & Group Sync app

Open User Provisioning/Sync for Jira plugin configuration. Go to the Configuration tab. Select Keycloak from the options.

User and gruop provisioning in Jira, Confluence, Bitbucket Select Provider

Enter custom App name, Client ID, Client secret, Keycloak base url and realm name. You will get Client ID and secret details in the Keycloak credentials tab. Also enter App name, base URL and realm name accordingly from Keycloak. You can schedule the synchronization process by using Set Scheduler Time Interval. Click on Save Settings.

User and gruop provisioning in Jira, Confluence, Bitbucket Configure Provider

Step 3: User Sync Settings

Select the User Sync Settings tab from the left sidebar. Here you can configure different settings about user creation and updation.

User and gruop provisioning in Jira, Confluence, Bitbucket User Sync

You can select the directory or can create a new one. Furthermore, you can choose from the following operations for provisioning users.
You also have an option to set Default Project Lead and Default Component Lead.

Step 4: Group Sync Settings

Select the Group Sync Settings tab from the left sidebar. Here you can configure different settings about group creation and group mapping.

User and gruop provisioning in Jira, Confluence, Bitbucket Group Sync

Here you can configure Default groups for new and all users.
You can set Manual Group Mapping or On-The Fly Group Mapping.

1. Manual Group Mapping -

Here you can manually map Jira groups with the groups from IDP.
You can also configure to import IDP groups, filter groups and whether to keep existing users or not.

User and gruop provisioning in Jira, Confluence, Bitbucket Manual Group Mapping

2. On-The Fly Group Mapping -

Here users will be assigned to groups in Jira whose group name is the same as groups from IDP. If the group doesn't exist in Jira then it will be created.
You can configure to keep the existing user groups, filter groups and apply regular expressions on the groups.

User and gruop provisioning in Jira, Confluence, Bitbucket On The Fly Group Mapping

Step 5: Synchronization Process

To perform user sync, click on the Synchronize option of your newly created app.
When the synchronization is complete, you will be able to view newly created and updated user information in Jira's User Management section.

User and gruop provisioning in Jira, Confluence, Bitbucket Synchronize

6: Multiple IDPs Settings

The plugin allows for configuring SCIM provisioning on your Jira to accommodate your specific use case. To add another IDP, simply navigate to the "Configured IDPs" section. Select on Add new App to configure multiple provisioning connections.