SAML SSO Single Sign On for Bitbucket SSO OAuth + User Sync

Compatibility release for Bitbucket 10.

• SAML Single Sign-On 6.15.3 comes with the User Sync 2.18.3 release, see 2.18.x release notes.
• Updated dependencies.

• SAML Single Sign-On 6.15.2 comes with the User Sync 2.18.2 release, see 2.18.x release notes.

• SAML Single Sign-On 6.15.0 comes with the User Sync 2.18.0 release, see 2.18.x release notes.
• Added support for Azure AD Domain Hints.
• Introduced a flag in SAML authentication trackers to track users who have been reactivated through Just-In-Time (JIT) provisioning.
• Added the possibility to include the SAML assertion in the user session for further processing.

• SAML Single Sign-On 6.15.0 comes with the User Sync 2.18.0 release, see 2.18.x release notes.
• Added support for Azure AD Domain Hints.
• Introduced a flag in SAML authentication trackers to track users who have been reactivated through Just-In-Time (JIT) provisioning.
• Added the possibility to include the SAML assertion in the user session for further processing.

Restored compatibility with older Bitbucket versions.

• SAML Single Sign-On 6.14.4 comes with the User Sync 2.17.4 release, see 2.17.x release notes.
• Enhanced security by generating new private keys with 4096 bits.
• Added a message to the tracker containing the cluster node for improved monitoring and diagnostics.
• Fixed an issue where the cron expression “0 0 2 * * ?” was incorrectly marked as invalid on April 30.
• Resolved missing license notifications for Bitbucket, ensuring proper alerts are displayed on failed logins.

• SAML Single Sign-On 6.14.4 comes with the User Sync 2.17.4 release, see 2.17.x release notes.
• Enhanced security by generating new private keys with 4096 bits.
• Added a message to the tracker containing the cluster node for improved monitoring and diagnostics.
• Fixed an issue where the cron expression “0 0 2 * * ?” was incorrectly marked as invalid on April 30.
• Resolved missing license notifications for Bitbucket, ensuring proper alerts are displayed on failed logins.

• SAML Single Sign-On 6.14.3 comes with the User Sync 2.17.3 release, see 2.17.x release notes.
• Fixed dependency issue that could cause problems with the user management pages after restarting a node.

• SAML Single Sign-On 6.14.3 comes with the User Sync 2.17.3 release, see 2.17.x release notes.
• Fixed dependency issue that could cause problems with the user management pages after restarting a node.

• SAML Single Sign-On 6.14.2 comes with the User Sync 2.17.2 release, see 2.17.x release notes.
• Resolved Groovy transformation failures caused by a hardcoded timeout.
• Fixed a typo in Security Settings/Token Signing Certificates.

• SAML Single Sign-On 6.14.2 comes with the User Sync 2.17.2 release, see 2.17.x release notes.
• Resolved Groovy transformation failures caused by a hardcoded timeout.
• Fixed a typo in Security Settings/Token Signing Certificates.

This is a maintenance release that updates external dependencies.

This is a maintenance release that updates external dependencies.

• SAML Single Sign-On 6.14.0 comes with the User Sync 2.17.0 release, see 2.17.x release notes.
• Allow cron schedule for tracker cleanup job: You can now configure a specific cron schedule for the tracker cleanup job, giving you more flexibility and control over cleanup intervals.
• Do not display WebSudo message when additional authentication is not enabled: If you have not set up extra authentication requirements, the WebSudo message no longer appears, helping to avoid unnecessary prompts.
• And more smaller improvements and fixes. See the full changelog for details.

• SAML Single Sign-On 6.14.0 comes with the User Sync 2.17.0 release, see 2.17.x release notes.
• Allow cron schedule for tracker cleanup job: You can now configure a specific cron schedule for the tracker cleanup job, giving you more flexibility and control over cleanup intervals.
• Do not display WebSudo message when additional authentication is not enabled: If you have not set up extra authentication requirements, the WebSudo message no longer appears, helping to avoid unnecessary prompts.
• And more smaller improvements and fixes. See the full changelog for details.

• SAML Single Sign-On 6.13.0 comes with the User Sync 2.16.0 release, see 2.16.x release notes.
• Added the possibility to add custom error messages from SAML responses to the error page template.
• Added a logout link to the WebSudo page when no SAML session is present.

• SAML Single Sign-On 6.13.0 comes with the User Sync 2.16.0 release, see 2.16.x release notes.
• Added the possibility to add custom error messages from SAML responses to the error page template.
• Added a logout link to the WebSudo page when no SAML session is present.

• SAML Single Sign-On 6.12.0 comes with the User Sync 2.15.0 release, see 2.15.x release notes.
• Fixed broken IdP buttons on the new 2FA login page, ensuring consistency in login options.
• Made IdP buttons fully customizable by removing the default "Login with" label, allowing for more flexible branding and messaging.
• Fixed an issue where multiple metadata reloads failed if the IdP’s entity ID already existed with createdFromMetadata set to false.
• Added support for query response mode in OIDC, enhancing flexibility in authentication requests.
• and more...

• SAML Single Sign-On 6.12.0 comes with the User Sync 2.15.0 release, see 2.15.x release notes.
• Fixed broken IdP buttons on the new 2FA login page, ensuring consistency in login options.
• Made IdP buttons fully customizable by removing the default "Login with" label, allowing for more flexible branding and messaging.
• Fixed an issue where multiple metadata reloads failed if the IdP’s entity ID already existed with createdFromMetadata set to false.
• Added support for query response mode in OIDC, enhancing flexibility in authentication requests.
• and more...

This bugfix release contains changes in User Sync, see User Sync 2.14.x release notes for more details.

This bugfix release contains changes in User Sync, see User Sync 2.14.x release notes for more details.

With this update, SAML SSO is compatible with Bitbucket 9. We also did the following:

• Added option to exclude certain IdPs from multi-idp metadata import
• SAML Single Sign-On 6.11.0 comes with the User Sync 2.14.0 release, see 2.14.x release notes.
• Added option to sort IdPs in IdP Selection Page Template
• Added a custom logger that records all successful and failed authentication of SAML

For more detailed release notes, please see here.

Please note:

• While Atlassian added WebSudo to Bitbucket 9, the WebSudo integration of SAML SSO does not work due to the limitations of Atlassian. Atlassian has created a feature request for this, see here. Please make sure that your Administrator account has a local password set because of this!

With this update, SAML SSO is compatible with Bitbucket 9. We also did the following:

• Added option to exclude certain IdPs from multi-idp metadata import
• SAML Single Sign-On 6.11.0 comes with the User Sync 2.14.0 release, see 2.14.x release notes.
• Added option to sort IdPs in IdP Selection Page Template
• Added a custom logger that records all successful and failed authentication of SAML

For more detailed release notes, please see here.

Please note:

• While Atlassian added WebSudo to Bitbucket 9, the WebSudo integration of SAML SSO does not work due to the limitations of Atlassian. Atlassian has created a feature request for this, see here. Please make sure that your Administrator account has a local password set because of this!

• SAML Single Sign-On 6.10.3 is bugfix release that only contains changes in User sync, see 2.13.x release notes for more details.

• SAML Single Sign-On 6.10.3 is bugfix release that only contains changes in User sync, see 2.13.x release notes for more details.

• SAML Single Sign-On 6.10.2 comes with the User Sync 2.13.1 release, see 2.13.x release notes.
• OIDC: Added RS512 to set of supported algorithms for JWT token validation
• Add option to exclude debug messages from being logged in authentication trackers.

• SAML Single Sign-On 6.10.2 comes with the User Sync 2.13.1 release, see 2.13.x release notes.
• OIDC: Added RS512 to set of supported algorithms for JWT token validation
• Add option to exclude debug messages from being logged in authentication trackers.

• Fixed bug in OAuth2/Social Login wizard for configuring a new IdP.
• Updated dependencies (Bouncy Castle).

• Fixed bug in OAuth2/Social Login wizard for configuring a new IdP.
• Updated dependencies (Bouncy Castle).

• SAML Single Sign-On 6.10.0 comes with the User Sync 2.13.0 release, see 2.13.x release notes.
• Now displays the last metadata reload date next to the option to reload metadata every day for better visibility and management.
• Ensured SAML authentication cannot proceed if the certificate is no longer valid, closing a security loophole.
• Eliminated an open redirect vulnerability associated with whitespace and control characters in the redirection path.
• Addressed an issue where "SaveIdPSelection" parameter in the IdP selection template did not behave as intended across different Tomcat versions.
• ... and more. See the release notes page for full details.

• SAML Single Sign-On 6.10.0 comes with the User Sync 2.13.0 release, see 2.13.x release notes.
• Now displays the last metadata reload date next to the option to reload metadata every day for better visibility and management.
• Ensured SAML authentication cannot proceed if the certificate is no longer valid, closing a security loophole.
• Eliminated an open redirect vulnerability associated with whitespace and control characters in the redirection path.
• Addressed an issue where "SaveIdPSelection" parameter in the IdP selection template did not behave as intended across different Tomcat versions.
• ... and more. See the release notes page for full details.

• SAML Single Sign-On 6.9.0 comes with the User Sync 2.12.0 release, see 2.12.x release notes.
• It's now possible to hide the login form when using the IdP selection button, see documentation for more details.
• The looks of the IdP selection buttons are customizable via template, see documentation for more details.
• Implemented a feature to pass the email address from the "IdP Selection by Email" field directly to the IdP to improve the login experience, see documentation for more details.

• SAML Single Sign-On 6.9.0 comes with the User Sync 2.12.0 release, see 2.12.x release notes.
• It's now possible to hide the login form when using the IdP selection button, see documentation for more details.
• The looks of the IdP selection buttons are customizable via template, see documentation for more details.
• Implemented a feature to pass the email address from the "IdP Selection by Email" field directly to the IdP to improve the login experience, see documentation for more details.

• Fixed issue where filtered LDAP users might be reactivated during login when "Update Users from Remote Directories" is enabled.

• Fixed issue where filtered LDAP users might be reactivated during login when "Update Users from Remote Directories" is enabled.

• SAML Single Sign-On 6.8.3 comes with the User Sync 2.11.3 release, see 2.11.x release notes.

• SAML Single Sign-On 6.8.3 comes with the User Sync 2.11.3 release, see 2.11.x release notes.

• SAML Single Sign-On 6.8.2 comes with the User Sync 2.11.2 release, see 2.11.x release notes.
• Fixed an issue in the AtlasUserResult where the isSuccess() method was missing. The absence of this method could disrupt Groovy Transformations and result in unexpected outcomes.

• SAML Single Sign-On 6.8.2 comes with the User Sync 2.11.2 release, see 2.11.x release notes.
• Fixed an issue in the AtlasUserResult where the isSuccess() method was missing. The absence of this method could disrupt Groovy Transformations and result in unexpected outcomes.

• SAML Single Sign-On 6.8.1 comes with the User Sync 2.11.1 release, see 2.11.x release notes.
• Improved error messages in trackers to make them more human-readable.
• Fixed: Resolved an issue where the multi-IdP metadata reload status was not updated in the configuration if a reload failed.

• SAML Single Sign-On 6.8.1 comes with the User Sync 2.11.1 release, see 2.11.x release notes.
• Improved error messages in trackers to make them more human-readable.
• Fixed: Resolved an issue where the multi-IdP metadata reload status was not updated in the configuration if a reload failed.

• SAML Single Sign-On 6.7.1 comes with the User Sync 2.10.1 release, see 2.10.x release notes. This update resolves high CPU and memory usage during synchronization.

• SAML Single Sign-On 6.7.1 comes with the User Sync 2.10.1 release, see 2.10.x release notes. This update resolves high CPU and memory usage during synchronization.

• SAML Single Sign-On 6.7.0 comes with the User Sync 2.10.0 release, see 2.10.x release notes.

• SAML Single Sign-On 6.7.0 comes with the User Sync 2.10.0 release, see 2.10.x release notes.

• SAML Single Sign-On 6.6.0 comes with the User Sync 2.9.0 release, see 2.9.x release notes.
• Added WebSudo support for OIDC.
• WebSudo: forceAuthentication can now be deactivated.
• Fixed: the Linchpin endpoints are no longer accessed from the frontend when not running on Confluence.

• SAML Single Sign-On 6.6.0 comes with the User Sync 2.9.0 release, see 2.9.x release notes.
• Added WebSudo support for OIDC.
• WebSudo: forceAuthentication can now be deactivated.
• Fixed: the Linchpin endpoints are no longer accessed from the frontend when not running on Confluence.

• This version includes a bugfix in User Sync 2.8.1, see 2.8.x release notes.

• This version includes a bugfix in User Sync 2.8.1, see 2.8.x release notes.

• SAML Single Sign-On 6.5.0 comes with the User Sync 2.8.0 release, see 2.8.x release notes.
• Added Relying Party Initiated Single Logout for OIDC: Logout from your identity provider and other connected services when logging out from your Atlassian product.
• Added optional IdP selection buttons on login page: Click a button to login via SSO as an alternative to using the redirection.
• Added "auth_fallback" as an additional nosso parameter.
• Added option to sign Single Logout responses.

• SAML Single Sign-On 6.5.0 comes with the User Sync 2.8.0 release, see 2.8.x release notes.
• Added Relying Party Initiated Single Logout for OIDC: Logout from your identity provider and other connected services when logging out from your Atlassian product.
• Added optional IdP selection buttons on login page: Click a button to login via SSO as an alternative to using the redirection.
• Added "auth_fallback" as an additional nosso parameter.
• Added option to sign Single Logout responses.

• SAML Single Sign-On 6.4.0 comes with the User Sync 2.7.1 release, see 2.7.x release notes.
• Added preset for OIDC with Ping One.
• Fixed logout issues when using OIDC.
• Fixed flickering authentication tracker UI for OIDC logins.
• Allow sending SAML authentication requests to a different URLs.
• Added metadata file import to the IdP page.

• SAML Single Sign-On 6.4.0 comes with the User Sync 2.7.1 release, see 2.7.x release notes.
• Added preset for OIDC with Ping One.
• Fixed logout issues when using OIDC.
• Fixed flickering authentication tracker UI for OIDC logins.
• Allow sending SAML authentication requests to a different URLs.
• Added metadata file import to the IdP page.

• Allow OAuth2 authentication with Atlassian, LinkedIn, GitHub, Twitter or Facebook
• Specific SP metadata can be provided per IdP
• Fix a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed .
• Please check our release notes for more details.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

• Allow OAuth2 authentication with Atlassian, LinkedIn, GitHub, Twitter or Facebook
• Specific SP metadata can be provided per IdP
• Fix a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed .
• Please check our release notes for more details.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.