Contents

User and Group Sync for Keycloak

The User & Group Sync app syncs user and group information from Keycloak to Jira, Confluence, and Bitbucket. Syncing user group attributes will sync user details such as groups, users, and directories. Sync can be performed manually or scheduled to run after set time intervals. By doing so, the administrator only has to manage user accounts in Keycloak. As a result, Atlassian modules such as Jira, Confluence, and Bitbucket require less admin time to create users and groups.

Download And Installation

Log into your atlassian instance as admin.
Navigate to the settings menu and Click Manage Apps.
Click on Find new apps .
Locate miniOrange User and Group Sync app.
Click Try free to begin a new trial or Buy now to purchase a license.
Enter your information and click Generate license when redirected to MyAtlassian.
Click Apply license.

Step 1: Setup Keycloak

First of all, login to your Keycloak dashboard.
Click on Clients from the left sidebar and Create new clients.

User and gruop provisioning in Jira, Confluence, Bitbucket Clients Sidebar

User and gruop provisioning in Jira, Confluence, Bitbucket Client Create

Enter a name as the Client id and select Client Protocol as open id connect.

User and gruop provisioning in Jira, Confluence, Bitbucket

Now, you will see the Settings page of the created client.

User and gruop provisioning in Jira, Confluence, Bitbucket Settings tab

Here, select Access Type as confidential . Make sure the options Standard Flow Enabled, Direct Access Grants Enabled, Service Accounts Enabled and Authorization Enabled options are turned on.
Also, against Valid redirect URIs put your Jira base URL. And then click on SAVE.
After saving, go to the Credentials tab on top. Save the client secret from here.

User and gruop provisioning in Jira, Confluence, Bitbucket Credentials tab

Now go to Roles from the top menu and select uma_protection.

User and gruop provisioning in Jira, Confluence, Bitbucket Roles tab

Under uma_protection, turn on Composite Roles and transfer all the Realm roles from Available Roles to Associated Roles.
Go to the Service account roles -> select "realm-management" and add the below highlighted scopes.

Step 2: Setup User Sync & Group Sync app

Open User Provisioning/Sync for Jira plugin configuration. Go to the Configuration tab. Select Keycloak from the options.

User and gruop provisioning in Jira, Confluence, Bitbucket Select Provider

Enter custom App name, Client ID, Client secret, Keycloak base url and realm name. You will get Client ID and secret details in the Keycloak credentials tab. Also enter App name, base URL and realm name accordingly from Keycloak. You can schedule the synchronization process by using Set Scheduler Time Interval. Click on Save Settings.

User and gruop provisioning in Jira, Confluence, Bitbucket Configure Provider

Step 3: User Sync Settings

Select the User Sync Settings tab from the left sidebar. Here you can configure different settings about user creation and updation.

User and gruop provisioning in Jira, Confluence, Bitbucket User Sync

You can select the directory or can create a new one. Furthermore, you can choose from the following operations for provisioning users.
You also have an option to set Default Project Lead and Default Component Lead.

Step 4: Group Sync Settings

Select the Group Sync Settings tab from the left sidebar. Here you can configure different settings about group creation and group mapping.

User and gruop provisioning in Jira, Confluence, Bitbucket Group Sync

Here you can configure Default groups for new and all users.
You can set Manual Group Mapping or On-The Fly Group Mapping.

1. Manual Group Mapping -

Here you can manually map Jira groups with the groups from IDP.
You can also configure to import IDP groups, filter groups and whether to keep existing users or not.

User and gruop provisioning in Jira, Confluence, Bitbucket Manual Group Mapping

2. On-The Fly Group Mapping -

Here users will be assigned to groups in Jira whose group name is the same as groups from IDP. If the group doesn't exist in Jira then it will be created.
You can configure to keep the existing user groups, filter groups and apply regular expressions on the groups.

User and gruop provisioning in Jira, Confluence, Bitbucket On The Fly Group Mapping

Step 5: Synchronization Process

To perform user sync, click on the Synchronize option of your newly created app.
When the synchronization is complete, you will be able to view newly created and updated user information in Jira's User Management section.

User and gruop provisioning in Jira, Confluence, Bitbucket Synchronize

6: Multiple IDPs Settings

The plugin allows for configuring SCIM provisioning on your Jira to accommodate your specific use case. To add another IDP, simply navigate to the "Configured IDPs" section. Select on Add new App to configure multiple provisioning connections.