# Atlassian

> Use Ironchip as the SAML identity provider in Atlassian Guard: create the application, set up SSO in admin.atlassian.com and enforce it for your users.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/atlassian/

Ironchip acts as the SAML identity provider of your Atlassian organization (Atlassian Guard). This guide explains how to set up single sign-on (SSO) and enforce it for your users.

## Requirements

- Be an administrator of an Atlassian organization.
- Subscribe to Atlassian Guard Standard from your organization and get familiar with how it works.
- Verify one or more domains in your organization. See [how to verify a domain](https://support.atlassian.com/user-management/docs/verify-a-domain-to-manage-accounts/).
- Make sure both your Atlassian product and your identity provider use HTTPS to communicate, and that the product's configured base URL is an HTTPS URL.
- Keep in mind that only email accounts from the domains associated with the policy can use SSO.

## Configure Ironchip

1. In the Ironchip admin console, go to **Applications** and click the green **New application** button.

   [Image: New application button in the Applications section of the Ironchip admin console]

2. Select the **SAML** type and download the metadata. You will use it in the next steps.

   [Image: SAML type selection and metadata download]

You will come back here later to finish the Ironchip configuration.

## Configure Atlassian

1. Go to `admin.atlassian.com` and select your organization if you have more than one.
2. Select **Security** > **Identity providers**.

   [Image: Security > Identity providers menu in Atlassian Admin]

3. Choose **Other provider** as the identity provider.

   [Image: Other provider selected as the identity provider]

4. Click **Set up SAML single sign-on**.

   [Image: Button to set up SAML single sign-on]

5. Add the SAML details, which are in the metadata file you downloaded from Ironchip.

   [Image: SAML details form in Atlassian]

6. Ironchip asks for a service provider metadata URL. To get one, edit this code with the Atlassian values:

   ```xml
   <?xml version="1.0" encoding="UTF-8"?>
   <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2122-09-16T10:40:54Z" cacheDuration="PT604800S" entityID="XXXXXXX">
     <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
       <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
       <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="XXXXXXXXXXXXXXXX" index="1" />
     </md:SPSSODescriptor>
   </md:EntityDescriptor>
   ```

   - Replace the `entityID` value with the **service provider entity URL**.
   - Replace the `Location` value with the **service provider Assertion Consumer Service URL**.

   [Image: Service provider entity and Assertion Consumer Service values in Atlassian]

7. Once you have generated the file, upload it to a publicly reachable address. Enter that URL, in raw format, in the **Metadata URL** field of the Ironchip new application dialog and click **Add application**.

   [Image: Metadata URL field in the Ironchip new application dialog]

8. In Atlassian, select your domain.

   [Image: Domain selection in Atlassian]

9. Save the configuration.

## Enforce SSO for your users

To make Ironchip the authentication method for your users:

1. Go to **Security** > **Authentication policies**.
2. Find the Ironchip policy you created and click **Edit**.

   [Image: Authentication policies list with the Edit option]

3. Under **Settings**, select the **Enforce single sign-on** checkbox.

   [Image: Enforce single sign-on checkbox in the policy]

4. Under **Members**, click **Add members**, choose one of the two methods (individual or bulk) and add the accounts you want to use Ironchip as their authentication method.

   [Image: Adding members to the authentication policy]

:::note
Only email accounts from the domains associated with the policy can use SSO.
:::

## Verify the integration

Before you test, give the user you will sign in with access to the Ironchip application. The steps are in [Add users to the service](https://docs.ironchip.com/en/identidad/protocolos/saml/#grant-access-to-users-and-groups).

1. Open a private window and sign in to your Atlassian product with an email account from a domain associated with the policy.
2. Atlassian redirects you to Ironchip to authenticate.
3. Complete the authentication on your device. Ironchip returns you to Atlassian with your session started.

## Troubleshooting

| Problem                                 | Likely cause                                                                                                                | Solution                                                                                            |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| Atlassian does not redirect to Ironchip | The account is not in the policy or its domain is not verified                                                              | Add the account under **Members** in the policy and check that the domain is verified               |
| Ironchip cannot read the metadata       | The XML is malformed, or the URL is not public or not in raw format                                                         | Check that `entityID` and `Location` are replaced and that the URL returns only the XML             |
| Atlassian does not recognize the user   | The metadata asks for the `emailAddress` `NameIDFormat` and the username of the access in Ironchip is not the account email | Edit the user's access to the application in Ironchip and set the username to their Atlassian email |