
## Simplifying Collaboration with OAuth SSO and SCIM {#how-atlassian-oauth-sso-and-scim-app-simplifies-user-management-and-collaboration}

Ever wondered how teams navigate the intricate landscape of digital collaboration and evolving workspaces? A team seamlessly orchestrating projects with tools like Jira and Confluence. But, as teams and projects grow, a new question arises: How do we simplify the authentication process without compromising security? To address the situation, the recommended approach is to incorporate the SCIM app with Atlassian OAuth Single Sign-On (SSO) for a more streamlined and effective solution.

&nbsp;

Jira excels as a project tracker, and Confluence plays a central role in collaborative content creation. User authentication across Atlassian products is crucial, and a robust Single Sign-On (SSO) solution becomes increasingly vital as these applications enhance productivity.

### Advancing Authentication: Atlassian OAuth SSO {#advancing-authentication}

Embracing the demand for streamlined and user-friendly authentication, Atlassian OAuth SSO emerges as a powerful evolution in secure access, eliminating the hassle of multiple passwords for users. As organizations navigate the complexities of growing teams and intricate projects, the shift to Atlassian OAuth SSO becomes a game-changer.

&nbsp;

However, for enhanced SSO and identity management, organizations turn to SCIM apps, either for Jira or Confluence – the transformative solution within the Atlassian ecosystem. Atlassian OAuth SSO ensures a streamlined login process, where users authenticate once through their identity provider (IdP) and gain secure access to Jira, and Confluence. However, the challenge lies in effective user provisioning and management.


### User Provisioning: The Missing Piece {#user-provisioning-the-missing-piece}

SCIM app transforms the puzzle of identity management into a work of art. It seamlessly integrates with Atlassian OAuth SSO, providing a unified solution for both authentication and user provisioning. Atlassian OAuth SSO brings the power of single sign-on, simplifying access for users across various Atlassian products. Meanwhile, SCIM app steps in as the missing piece, extending this simplicity to user provisioning, ensuring that user information is consistently accurate and up-to-date.

&nbsp;

This integration doesn't just stop at efficiency; it also fortifies security. By combining the robust authentication of Atlassian OAuth SSO with the seamless provisioning of SCIM, organizations can create a fortress of identity management. This not only safeguards against unauthorized access but also ensures that the right individuals have the right level of access at all times.

&nbsp;

Let's dive into how this dynamic duo, Atlassian OAuth SSO+SCIM App, can redefine your collaboration experience.


### Instant Gratification: Immediate User Provisioning {#instant-gratification-immediate-user-provisioning}

The concept of "Instant Gratification" within the context of SCIM app immediate user provisioning heralds a significant transformation in the landscape of user onboarding processes. In traditional systems, there exists a temporal gap between the moment a user is added to an identity provider and when they are granted access to specific applications, such as those provided by Atlassian.

&nbsp;

SCIM addresses this challenge by introducing a revolutionary approach that eliminates the delays associated with user provisioning. No more delays between adding a user to your identity provider and gaining access to Atlassian applications. This boosts efficiency, minimizes disruptions, and ensures that your team has instant access to the tools they need.

&nbsp;


### Dynamic Group Mapping: Effortless Synchronization {#dynamic-group-mapping-effortless-synchronization}

Mapping Identity Provider (IdP) groups to application groups with SCIM, streamlines user group and permission management. This enables automatic assignment and updates of user groups and permissions based on changes in IdP groups. For instance, if a user belongs to the administrators group on IdP, admin permissions can be assigned through mapping. If the user is later removed from the administrators group on IdP, they will be automatically removed from the application admin group.

&nbsp;

The mapping process provides two distinctive approaches: **Manual Group Mapping and On-The-Fly Group Mapping**. Manual Group Mapping is the preferred choice when there is a disparity between IdP group names and local application group names, necessitating the manual association of each IdP group with its counterpart in the application. On-the-Fly Group Mapping, on the other hand, is advantageous when IdP group names precisely match local application group names.

&nbsp;


### Syncing User Status with Ease {#syncing-user-status-with-ease}

While Atlassian OAuth SSO provides a robust single sign-on solution, ensuring synchronized user statuses poses a considerable challenge. In response, SCIM app emerges as the essential tool for seamlessly managing user status changes throughout your Atlassian suite, encompassing Jira and Confluence.

&nbsp;

When a user departs from an organization, SCIM app promptly deactivates their accounts across all integrated platforms. This proactive measure not only enhances security by swiftly revoking access but also simplifies the intricate process of user management. SCIM's synchronization capabilities extend beyond mere deactivation; it enables real-time updates, promptly reflecting changes in user roles and permissions across Atlassian applications. This not only ensures enhanced security but also contributes to cost savings by efficiently managing licenses through timely deactivation.

&nbsp;

### Tailored User Identities: Modify Group and Usernames {#tailored-user-identities-modify-group-and-usernames}

SCIM app allows you to modify groups and usernames with special rules. By implementing customized rules for groups and usernames, organizations can not only achieve uniformity but also bolster their security posture. Moreover, our SCIM app  provides the ability to transform usernames systematically, ensuring that they adhere to your organization's standards.

&nbsp;

This not only promotes clarity but also aids in preventing potential security vulnerabilities associated with inconsistent or non-compliant usernames. Consistent and well-structured user identities across applications contribute to a more efficient and secure identity management system, ultimately enhancing the overall cybersecurity framework of your organization.

&nbsp;

### Attributes Redefined: Mapping and Customization {#attributes-redefined-mapping-and-customization}

Attribute mapping involves associating specific user details. By mapping key attributes like username, email, mobile number, and display name to your identity provider, you ensure precise user profiles, fostering a seamless environment across Atlassian applications. This process guarantees consistency and accuracy in user profiles across various platforms.

&nbsp;

It enables organizations to synchronize and uphold uniform information, promoting seamless data exchange and enhancing overall system interoperability. Attribute mapping and customization not only boost accuracy but also contribute to a more personalized and efficient user experience.

&nbsp;

### Embrace the Power: Atlassian OAuth SSO+SCIM App {#embrace-the-power-atlassian-oauth-sso-scim-app}

In a nutshell, Atlassian OAuth SSO+SCIM app is your ticket to streamlined user management and heightened security. While OAuth SSO ensures secure authentication, SCIM takes user provisioning and management to the next level. With immediate provisioning, automated group mapping, and real-time updates, organizations can elevate their security, compliance, and user experience across Atlassian's collaborative tools.

&nbsp;

Don't wait! Embrace the power of Atlassian OAuth SSO+SCIM App today. Experience a compelling solution that makes managing users in Atlassian's collaborative tools easier than ever. For a demo, reach us at **+1 978 658 9387**or email your queries to **support-atlassian@miniorange.atlassian.net**. We're eager to hear from you.



The Atlassian OAuth SSO+SCIM DC combination is not just a solution; it's an invitation to elevate your collaboration effortlessly. In this article, let’s go on a journey into the dynamics of Atlassian OAuth SSO paired with SCIM DC. A powerful integration that redefines user authentication, provisioning, and management across Jira and Crowd. Uncover the seamless synergy of this transformative duo as it elevates the overall user experience.

How Atlassian OAuth SSO and SCIM App Simplifies User Management and Collaboration


## Managing Bulk Users: Features & More! {#managing-bulk-users-features-more}

The bulk user management add-on ensures users can manage their accounts more efficiently using the Bulk User Management add-on. It makes it possible to perform actions such as import/export users, bulk delete, or even deactivate inactive users.

**Let’s have a look at the features Bulk user management has:** 

&nbsp;&nbsp;

### Import-Export Users {#import-export-users}

With this feature, we can import and export users of an organization into JIRA. If the data of users are stored in CSV format then it can easily be imported into JIRA. 

&nbsp;

With the export users, we can easily export users from JIRA into CSV format. Also, it is possible to export specific details such as username, email, full name, groups, status, and directory. 

&nbsp;

![bulk-user-management](/blog/assets/2023/bulk-user-management-feature.webp)

### Audit Logs {#audit-logs}

&nbsp;

With this feature the logs or the recent activity performed related to User activation, deactivation, import, export, and scheduler enabled by the admin will be displayed. The feature has many filters. Based on IP address, User name, Actions, and past days the logs can be displayed. This feature is helpful for tracking the activity. Past 6 months’ data can be displayed using this feature. 

![audit-logs](/blog/assets/2023/bulk-user-management-audit-logs.webp)

### Deactivate Users {#deactivate-users}

One of the main features of Bulk User Management is deactivating users. It also has many additional features within deactivating users like Auto deactivate users, Deactivate never logged in users, Exclude groups for auto deactivation and Days after which the scheduler should be planned.

&nbsp;

Auto-deactivate users as the name suggests helps you automatically delete users. It lets you deactivate users who haven’t logged in for a particular amount of days.

&nbsp;

Let’s say you want users who haven’t logged in for 20 days to be deactivated, all you have to do is enable the auto deactivate users button and the users who haven’t logged in for 20 days will be deactivated. You  can also deactivate never logged in users. You can exclude  a particular group for auto deactivation. Hence users from that particular group will not be deactivated even if they haven’t logged in for the number of days you have selected in the days option for auto deactivate users. 

&nbsp;

The scheduler helps you run the cycle of deactivation after every specific number of days.The scheduler runs after every certain number of days selected by the admin and hence the process would be performed after every cycle is complete and thus automate the whole process. 

&nbsp;

### Bulk User Management {#bulk-user-management}

&nbsp;

As the name suggests Bulk user management feature helps you manage your users in bulk or perform actions in bulk. There are various filter options which are provided such as : Enter username or full name, Filter group, how many users you want per page, All users, Active users, Inactive users, Action on user and action on group.

&nbsp;

With enter user name and filter group feature you can see a particular user or users in a particular group only and then perform the desired action on them.

&nbsp;

If you want to see upto 10 users in the first go then the how many users you want per page comes into action. You can select how many users you want to see in one go by using it.

&nbsp;

The feature of All users helps you see all your users and you can also separate the active users and the inactive ones by just clicking a button.

&nbsp;

You can also choose to perform actions like deactivate user, activate user and delete users on the filtered group of users selected by you using the above filters. One can also add and remove one or many users from a group. All the actions can be performed in bulk and you will not have to select one-one user every time and perform the action.

&nbsp;

A lot of details of your users are provided on the first page. They are: Username, Email, Display name, Groups, Directory, Status and their last login time.

&nbsp;

You can also click on the username in the list and get detailed information about that particular user. By clicking on the groups option from the list one can see what are the Permission schemes, Notification schemes, Issue security schemes and saved filters of the group.

&nbsp;

Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.


The bulk user management add-on ensures users can manage their accounts more efficiently using the Bulk User Management add-on. It makes it possible to perform actions such as import/export users, bulk delete, or even deactivate inactive users.

Managing Bulk Users: Features & More!


## Secure Jira Datacenter With Password Policy Manager {#secure-jira-datacenter-with-password-policy-manager}

**Password security** is very important in today’s digital world. Atlassian allows you to create a secure environment by letting admins set password policies for users which specify the number of characters, type, and special characters. 
 
&nbsp;

![password-policy](/blog/assets/2023/advanced-password-policy.webp)


[Advanced Password Policy Manager](https://marketplace.atlassian.com/apps/1228420/advanced-password-policy-manager-for-jira?hosting=datacenter&tab=overview) takes Jira password security to a different level, allowing you to set **tailored password policies**. It helps in improving password security and building **stronger system security**.  

With the add-on, you can allow the admin to set a **custom password** with the help of regular expressions. You can configure a set of **rules** using **regular expressions** (regex) that should be followed by the user while setting/updating their passwords.

&nbsp;

Admins can set multiple security policies like **length** of the **password**, **periodic password change**, as users allow access to a lot of sensitive information while using multiple applications, it is recommended for the Admins to enforce change of passwords frequently for the employees to keep the **data safe**. Admins can also set a **password expiry time** by forcing users to reset their passwords after a certain number of days in order to protect Jira from password interceptions. Admins can also send customized expiry notifications to users when their password expires. 

 &nbsp;

The admin can **limit login attempts**, i.e. the number of failed attempts by users to login, and can restrict access to Jira and JSM by **locking** the user accounts. Password policies can be enabled for your customers and agents for the ServiceDesk customer portal.

&nbsp;

![password-policy-manager](/blog/assets/2023/manage-user-accounts.webp)
 

We have much more on our plate to offer you in our Advanced Password Policy for Jira, here are the **upcoming features**:

- Create **multiple password policies** & assign them to certain users or groups based on their **roles**.
- **Customizable** templates for email notifications.
- **Force** certain users to **reset** their password.
 

Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.


Password security is very important in today’s digital world. Atlassian allows you to create a secure environment by letting admins set password policies for users which specify the number of characters, type, and special characters. 

Secure Jira Datacenter With Password Policy Manager


Your accounts are protected with a password but it might not always be secure. Let’s say you are out with your family and your kid wants to buy a toy and you hand in your credit card to pay for it but it keeps getting declined. You are sure that you have enough balance in it to pay for it, but when you check your bank statement it shows it’s in negative and all your negative thoughts end up coming true.

This means that you have been hacked.

Similar issues might happen with your Jira as well. Hackers out there are always ready to pounce on weak passwords, vulnerabilities or leaks in data. This will lead to the possible revealing of your confidential company data. 

What can you do about it?

Well, don’t worry! You can add an extra layer of security with two-factor authentication.

&nbsp;&nbsp;  

**Two-Factor Authentication (2FA)**, also called two-step verification, is a security process in which a user has to pass two different authentication checks to gain access to their account. It helps you prohibit unauthorized access to your application.

To know more about protecting your Atlassian cloud applications check out our previous blog:-
[How to secure Atlassian cloud applications](https://community.atlassian.com/t5/Atlassian-Access-articles/How-to-secure-Atlassian-Cloud-Applications/ba-p/1728600)

[Enable 2FA on Jira for your Customers and skip 2FA for Employees!](https://community.atlassian.com/t5/Jira-articles/Enable-2FA-on-Jira-for-your-Customers-and-skip-2FA-for-Employees/ba-p/1719062)

As 2FA functionality is not already provided in Atlassian Server and Data Center, you can use miniOrange 2FA plugins to enable the 2nd factor of authentication and strengthen access to your Jira accounts. 

Our miniOrange plugin provides you with various 2FA authentication methods like OTP over email, OTP over SMS, Google authenticator, Security questions, Yubikey hardware token, etc.

### OTP over SMS/ Email {#otp-over-email}

OTP (One Time Password) is the most famous & convenient validation technique used by a large number of organizations for two-factor authentication. The OTPs are short-lived and are shared with the user at the time of login. That makes it impossible for the hackers to get access to accounts even if they have user’s credentials.

In the SMS OTP validation technique, an OTP is sent to the user’s mobile phone via SMS. The user has to enter it during the 2FA verification step and the user gets application access only if the OTP is correct. 

We also provide the feature of OTP over Email. Here, the OTP is shipped off to the users on their registered email address. When a user attempts to log in to any device, the server sends an email to their registered company email address with the OTP. The user can then use this OTP to log in.

### Advantages of OTP over SMS and Email {#advantages-of-otp-over-sms-email}

- **Low cost & Ready rollout:**

Since mobile phones and email are readily available to everyone, the cost of implementing OTP over SMS and OTP over Email is very low as one doesn’t need anything extra. (If you use hardware tokens as a 2FA method then each user will need a dedicated hardware device)

- **Easy to use (No setup & no instructions):**

Execution of on-demand OTP delivery techniques is moderately easy for organizations. For instance, with SMS delivery, users don’t have to do any kind of setup and don’t need any extra applications, like authenticator apps, to be installed on their device. They just demand a code which they use at login. 

- **No Shared Secret to Crack:**

On-request OTPs are simply arbitrary numbers sent by the server at the time of login, so there’s no shared secret to be taken advantage of.

&nbsp;&nbsp;  

Reach out to us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket by [clicking here.](https://miniorange.atlassian.net/servicedesk/customer/portal/2)

Two-factor authentication (2FA) adds an extra layer of security to your Jira account by requiring a one-time code (OTP) in addition to your password. To enable 2FA on Jira using OTP over SMS or email, miniOrange provides add-on for Atlassian Jira. 2FA benefits include increased security, reduced risk of data breaches, and compliance with regulations.

Secure your Jira with 2FA (OTP over SMS/ Email)


## SAML/OAuth SSO for JSM Customers {#saml-oauth-sso-for-jsm-customers}

Introducing our most awaited add-on: [SAML/OAuth SSO for JSM Customers.](https://marketplace.atlassian.com/apps/1229212/sso-integration-with-helpdesks-for-customers?hosting=cloud&tab=overview)

&nbsp;&nbsp;

Could you imagine what it would be like if I told you that external customers can now log in via SSO to your Jira Service Management portals? We’ve got your back with our exclusive solution, SAML/OAuth SSO for JSM Customers.

### What does JSM SSO solve? {#what-does-jsm-sso-solve}

&nbsp;

If you keep your customer portal public, i.e. any anonymous user can raise a ticket on it, then there might be cases where your customer portal can be spammed by fake tickets. Managing these tickets could be very troublesome. In this scenario, Jira admins choose only the verified customers who have an account in their IDP should be allowed to raise and access tickets on the portal. Atlassian alone doesn’t allow you to do so. This is where miniOrange comes in with the JSM SSO solution.

&nbsp;

Another approach might be to add your external customer as a user in your JSM. To do so, you will have to verify his domain, and add him as a user in Jira and Atlassian access. Seems a bit tedious and expensive, yet unable to fulfill your complete requirements? miniOrange saves you from all of these hassles while fulfilling your use case.

No prerequisites required:

1. Domain Verification not required
2. Atlassian Access not required

&nbsp;

So in a nutshell, miniOrange solution, SAML/OAuth SSO for JSM Customers, is the best of both worlds. It helps in the prevention of spam ticket creation by allowing SSO for external customers and eliminating the need to add your customers as users in Jira and then grant them Atlassian access.
 
### Let’s see how? {#lets-see-how?}


With the help of our plugin your customers who are stored in any IDP (miniOrange, Okta, Azure AD, etc) will be able to login into your JSM or JSD via a link provided by our solution to the admin.
As soon as the customer clicks on the link they will be redirected to their IDP for authentication. Once authenticated the customers can raise and view the issues with ease.

A step by step user flow is explained below.

&nbsp;&nbsp;

![JSM](/blog/assets/2023/jsm.webp)

&nbsp;

The whole flow of our plugin is explained below in layman terms :

&nbsp;

1. Customer tries to access the JSM through the portal link provided by the admin. 
2. The customer will be redirected to the IDP for authentication.
3. User session is created on the portal.
4. Customers are now allowed to access and interact with the portal.
 
&nbsp;&nbsp;


It will be available across all Single Sign On protocols. We’ve already released the product with  SAML support and soon will be supporting OAuth,Open ID, and other protocols as well.

&nbsp;&nbsp;

**Upcoming Features:**

- Multiple IDP support.
- Two Factor Authentication on top of SSO.
- Domain restricted sign-up for external customers. 
- Domain based allow list for External Customer Accounts.
- Automatically adding customers to organizations based on email domain.

[Check out this link for further details.](https://miniorange.com/atlassian/sso-for-jsm-customers)




Could you imagine what it would be like if I told you that external customers can now log in via SSO to your Jira Service Management portals? We’ve got your back with our exclusive solution, SAML/OAuth SSO for JSM Customers.

SAML/OAuth SSO for JSM Customers


## Want extra features on top of Native SSO? {#want-extra-features-on-top-of-native-sso?}

[Advanced Option for Atlassian SSO Plugin](https://marketplace.atlassian.com/apps/1229209/advance-options-for-atlassian-sso?hosting=datacenter&tab=overview)

Our single sign-on feature has been an integral part of  Atlassian’s products for a prolonged time. It gives us great pleasure to say that its demand has increased manifold in the past few years.

### What makes SSO special? {#what-makes-sso-special?}

Well, the answer is pretty simple, SSO enables the users to sign in securely to their multiple independent applications. Users enter their login credentials only once that are stored in the Identity Provider.

**Is this all you need? What if you could decide how your users log in to Jira and JSM?**

We provide additional features on top of your Atlassian native SSO, miniOrange’s [advanced option for the SSO plugin](https://marketplace.atlassian.com/apps/1229209/advance-options-for-atlassian-sso?hosting=datacenter&tab=overview).

Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.

&nbsp;&nbsp;

Since the basic use case of SSO is satisfied by the Native SSO already, hence we decided to enhance the functionality of SSO by offering two distinct features :- 

1. SSO Redirection Policy
- Default rule (redirect to URL or IDP)
- Domain based redirection
- Group based redirection
 
&nbsp;&nbsp;

2. SSO Authentication Template
- Login Template
- Logout Template

1. **SSO Redirection Policy:**
This allows the users to have a set of rules that will decide how users will log in to Jira and JSM. Depending on the configuration, you can choose which users need to be re-directed to the configured IDP or the login page. Every end-user will be required to enter the username or email address, then they will  be matched against some pre-configured rules by the admin.

- Default rule –

URL or IDP – enabling this rule will redirect your users directly to the intended URL or IDP without clicking on any buttons or links.
- Domain based redirection –

This redirects the users to the configured IDP or Jira login page on the basis of the domain of the user.
- Group based redirection –

It redirects the users to the IDP or Jira login page on the basis of the groups they belong to. 

You can set multiple rules and decide their order of priority.

&nbsp;&nbsp;

2. **SSO Authentication Template :**

&nbsp;

We understand the importance of visual aesthetic and ease of understanding! This is exactly what this feature does, it gives the flexibility to the user to design their login and logout template as per their requirement. They can make it visually appealing or     customize it as they like to.

&nbsp;&nbsp;

**Design the UI of login template:**

- Custom login template : To enhance the look and feel of login page UI custom login template will allow you to customize and display an easy-to-use login page to the end-users.
- Custom logout template : Pretty similar to login template, it can be used to change the message after the user has logged out and show any custom message.

Wait! That’s not all. We have some exciting upcoming features too 

- Advance on-the-fly group provisioning
- Manual group mapping
- Group filter
- Group regex
- Additional user properties
 
Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





SO enables the users to sign in securely to their multiple independent applications. Users enter their login credentials only once that are stored in the Identity Provider.