SAML SSO Single Sign On for Jira SSO OAuth + User Sync

Compatibility release for Jira 11.

• SAML Single Sign-On 6.15.3 comes with the User Sync 2.18.3 release, see 2.18.x release notes.
• Updated dependencies.

• SAML Single Sign-On 6.15.2 comes with the User Sync 2.18.2 release, see 2.18.x release notes.

• SAML Single Sign-On 6.15.1 comes with the User Sync 2.18.1 release, see 2.18.x release notes.
• Added support for Azure AD Domain Hints.
• Introduced a flag in SAML authentication trackers to track users who have been reactivated through Just-In-Time (JIT) provisioning.
• Added the possibility to include the SAML assertion in the user session for further processing.

• SAML Single Sign-On 6.15.0 comes with the User Sync 2.18.0 release, see 2.18.x release notes.
• Added support for Azure AD Domain Hints.
• Introduced a flag in SAML authentication trackers to track users who have been reactivated through Just-In-Time (JIT) provisioning.
• Added the possibility to include the SAML assertion in the user session for further processing.

Restored compatibility with older Jira versions.

• SAML Single Sign-On 6.14.4 comes with the User Sync 2.17.4 release, see 2.17.x release notes.
• Enhanced security by generating new private keys with 4096 bits.
• Added a message to the tracker containing the cluster node for improved monitoring and diagnostics.
• Fixed an issue where the cron expression “0 0 2 * * ?” was incorrectly marked as invalid on April 30.
• Updated portal naming to include the Service Desk project name when it differs from the portal name, enhancing clarity for users.

• SAML Single Sign-On 6.14.4 comes with the User Sync 2.17.4 release, see 2.17.x release notes.
• Enhanced security by generating new private keys with 4096 bits.
• Added a message to the tracker containing the cluster node for improved monitoring and diagnostics.
• Fixed an issue where the cron expression “0 0 2 * * ?” was incorrectly marked as invalid on April 30.
• Updated portal naming to include the Service Desk project name when it differs from the portal name, enhancing clarity for users.

• SAML Single Sign-On 6.14.3 comes with the User Sync 2.17.3 release, see 2.17.x release notes.
• Fixed dependency issue that could cause problems with the user management pages after restarting a node.

• SAML Single Sign-On 6.14.3 comes with the User Sync 2.17.3 release, see 2.17.x release notes.
• Fixed dependency issue that could cause problems with the user management pages after restarting a node.

• SAML Single Sign-On 6.14.2 comes with the User Sync 2.17.2 release, see 2.17.x release notes.
• Resolved Groovy transformation failures caused by a hardcoded timeout.
• Fixed a typo in Security Settings/Token Signing Certificates.
• Modified the handling of the same-site cookie attribute on the session cookie in Jira 10.

• SAML Single Sign-On 6.14.2 comes with the User Sync 2.17.2 release, see 2.17.x release notes.
• Resolved Groovy transformation failures caused by a hardcoded timeout.
• Fixed a typo in Security Settings/Token Signing Certificates.
• Modified the handling of the same-site cookie attribute on the session cookie in Jira 10.

This is a maintenance release that updates external dependencies.

This is a maintenance release that updates external dependencies.

• SAML Single Sign-On 6.14.0 comes with the User Sync 2.17.0 release, see 2.17.x release notes.
• Allow cron schedule for tracker cleanup job: You can now configure a specific cron schedule for the tracker cleanup job, giving you more flexibility and control over cleanup intervals.
• Do not display WebSudo message when additional authentication is not enabled: If you have not set up extra authentication requirements, the WebSudo message no longer appears, helping to avoid unnecessary prompts.
• And more smaller improvements and fixes. See the full changelog for details.

• SAML Single Sign-On 6.14.0 comes with the User Sync 2.17.0 release, see 2.17.x release notes.
• Allow cron schedule for tracker cleanup job: You can now configure a specific cron schedule for the tracker cleanup job, giving you more flexibility and control over cleanup intervals.
• Do not display WebSudo message when additional authentication is not enabled: If you have not set up extra authentication requirements, the WebSudo message no longer appears, helping to avoid unnecessary prompts.
• And more smaller improvements and fixes. See the full changelog for details.

• SAML Single Sign-On 6.13.0 comes with the User Sync 2.16.0 release, see 2.16.x release notes.
• Added the possibility to add custom error messages from SAML responses to the error page template.
• Added a logout link to the WebSudo page when no SAML session is present.

• SAML Single Sign-On 6.13.0 comes with the User Sync 2.16.0 release, see 2.16.x release notes.
• Added the possibility to add custom error messages from SAML responses to the error page template.
• Added a logout link to the WebSudo page when no SAML session is present.

• SAML Single Sign-On 6.12.0 comes with the User Sync 2.15.0 release, see 2.15.x release notes.
• Implemented WebSudo support for the admin page to enhance security by requiring administrator re-authentication.
• Added the option to hide the login form on WebSudo page.
• Implemented enhancements to the email selection page to direct entered emails to non-SSO login, streamlining the login experience for users bypassing SSO.
• Fixed broken IdP buttons on the new 2FA login page, ensuring consistency in login options.
• Made IdP buttons fully customizable by removing the default "Login with" label, allowing for more flexible branding and messaging.
• Fixed an issue where multiple metadata reloads failed if the IdP’s entity ID already existed with createdFromMetadata set to false.
• Added support for query response mode in OIDC, enhancing flexibility in authentication requests.
• and more...

• SAML Single Sign-On 6.12.0 comes with the User Sync 2.15.0 release, see 2.15.x release notes.
• Implemented WebSudo support for the admin page to enhance security by requiring administrator re-authentication.
• Added the option to hide the login form on WebSudo page.
• Implemented enhancements to the email selection page to direct entered emails to non-SSO login, streamlining the login experience for users bypassing SSO.
• Fixed broken IdP buttons on the new 2FA login page, ensuring consistency in login options.
• Made IdP buttons fully customizable by removing the default "Login with" label, allowing for more flexible branding and messaging.
• Fixed an issue where multiple metadata reloads failed if the IdP’s entity ID already existed with createdFromMetadata set to false.
• Added support for query response mode in OIDC, enhancing flexibility in authentication requests.
• and more...

• SAML Single Sign-On 6.11.3 comes with the User Sync 2.14.3 release, see 2.14.x release notes.
• Added Jira 10 compatiblity.

• SAML Single Sign-On 6.11.3 comes with the User Sync 2.14.3 release, see 2.14.x release notes.
• Added Jira 10 compatiblity.

This bugfix release contains changes in User Sync, see User Sync 2.14.x release notes for more details.

This bugfix release contains changes in User Sync, see User Sync 2.14.x release notes for more details.

• SAML Single Sign-On 6.10.3 is bugfix release that only contains changes in User sync, see 2.13.x release notes for more details.

• SAML Single Sign-On 6.10.3 is bugfix release that only contains changes in User sync, see 2.13.x release notes for more details.

• SAML Single Sign-On 6.10.2 comes with the User Sync 2.13.1 release, see 2.13.x release notes.
• OIDC: Added RS512 to set of supported algorithms for JWT token validation
• Add option to exclude debug messages from being logged in authentication trackers.

• SAML Single Sign-On 6.10.2 comes with the User Sync 2.13.1 release, see 2.13.x release notes.
• OIDC: Added RS512 to set of supported algorithms for JWT token validation
• Add option to exclude debug messages from being logged in authentication trackers.

• Fixed bug in OAuth2/Social Login wizard for configuring a new IdP.
• Updated dependencies (Bouncy Castle).

• Fixed bug in OAuth2/Social Login wizard for configuring a new IdP.
• Updated dependencies (Bouncy Castle).

• SAML Single Sign-On 6.10.0 comes with the User Sync 2.13.0 release, see 2.13.x release notes.
• Simplified SSO redirection management for JSM Portals with the introduction of an exclusion list, making it easier to define and manage exceptions.
• Added an optional feature for rewriting /visitportal URLs to improve user navigation.
• Fixed an issue where logouts were not being recorded in the audit log.
• Now displays the last metadata reload date next to the option to reload metadata every day for better visibility and management.
• Ensured SAML authentication cannot proceed if the certificate is no longer valid, closing a security loophole.
• Eliminated an open redirect vulnerability associated with whitespace and control characters in the redirection path.
• Addressed an issue where "SaveIdPSelection" parameter in the IdP selection template did not behave as intended across different Tomcat versions.
• ... and more. See the release notes page for full details.

• SAML Single Sign-On 6.10.0 comes with the User Sync 2.13.0 release, see 2.13.x release notes.
• Simplified SSO redirection management for JSM Portals with the introduction of an exclusion list, making it easier to define and manage exceptions.
• Added an optional feature for rewriting /visitportal URLs to improve user navigation.
• Fixed an issue where logouts were not being recorded in the audit log.
• Now displays the last metadata reload date next to the option to reload metadata every day for better visibility and management.
• Ensured SAML authentication cannot proceed if the certificate is no longer valid, closing a security loophole.
• Eliminated an open redirect vulnerability associated with whitespace and control characters in the redirection path.
• Addressed an issue where "SaveIdPSelection" parameter in the IdP selection template did not behave as intended across different Tomcat versions.
• ... and more. See the release notes page for full details.

• SAML Single Sign-On 6.9.0 comes with the User Sync 2.12.0 release, see 2.12.x release notes.
• It's now possible to hide the login form when using the IdP selection button, see documentation for more details.
• The looks of the IdP selection buttons are customizable via template, see documentation for more details.
• Implemented a feature to pass the email address from the "IdP Selection by Email" field directly to the IdP to improve the login experience, see documentation for more details.

• SAML Single Sign-On 6.9.0 comes with the User Sync 2.12.0 release, see 2.12.x release notes.
• It's now possible to hide the login form when using the IdP selection button, see documentation for more details.
• The looks of the IdP selection buttons are customizable via template, see documentation for more details.
• Implemented a feature to pass the email address from the "IdP Selection by Email" field directly to the IdP to improve the login experience, see documentation for more details.

• Fixed issue where filtered LDAP users might be reactivated during login when "Update Users from Remote Directories" is enabled.

• Fixed issue where filtered LDAP users might be reactivated during login when "Update Users from Remote Directories" is enabled.

• SAML Single Sign-On 6.8.3 comes with the User Sync 2.11.3 release, see 2.11.x release notes.
• Fixed an issue where a base URL warning was displayed in the WebSudo popup.

• SAML Single Sign-On 6.8.3 comes with the User Sync 2.11.3 release, see 2.11.x release notes.
• Fixed an issue where a base URL warning was displayed in the WebSudo popup.

• SAML Single Sign-On 6.8.2 comes with the User Sync 2.11.2 release, see 2.11.x release notes.
• Fixed an issue in the AtlasUserResult where the isSuccess() method was missing. The absence of this method could disrupt Groovy Transformations and result in unexpected outcomes.
• Fixed an issue where the relayState was not retained when the "Display a button on Jira's Dashboard login gadget and login page" option was enabled, and as a result, the URL behind IdP-Login-Buttons did not contain the original URL.

• SAML Single Sign-On 6.8.2 comes with the User Sync 2.11.2 release, see 2.11.x release notes.
• Fixed an issue in the AtlasUserResult where the isSuccess() method was missing. The absence of this method could disrupt Groovy Transformations and result in unexpected outcomes.
• Fixed an issue where the relayState was not retained when the "Display a button on Jira's Dashboard login gadget and login page" option was enabled, and as a result, the URL behind IdP-Login-Buttons did not contain the original URL.

• SAML Single Sign-On 6.8.1 comes with the User Sync 2.11.1 release, see 2.11.x release notes.
• Improved error messages in trackers to make them more human-readable.
• Fixed: Resolved an issue where the multi-IdP metadata reload status was not updated in the configuration if a reload failed.
• Fixed a problem where Jira Service Management would redirect to the login page without redirection being enabled, ensuring proper redirection behavior as expected.

• SAML Single Sign-On 6.8.1 comes with the User Sync 2.11.1 release, see 2.11.x release notes.
• Improved error messages in trackers to make them more human-readable.
• Fixed: Resolved an issue where the multi-IdP metadata reload status was not updated in the configuration if a reload failed.
• Fixed a problem where Jira Service Management would redirect to the login page without redirection being enabled, ensuring proper redirection behavior as expected.

• SAML Single Sign-On 6.7.1 comes with the User Sync 2.10.1 release, see 2.10.x release notes. This update resolves high CPU and memory usage during synchronization.

• SAML Single Sign-On 6.7.1 comes with the User Sync 2.10.1 release, see 2.10.x release notes. This update resolves high CPU and memory usage during synchronization.

• SAML Single Sign-On 6.7.0 comes with the User Sync 2.10.0 release, see 2.10.x release notes.
• Added Single Logout for OIDC in Jira Service Management.

• SAML Single Sign-On 6.7.0 comes with the User Sync 2.10.0 release, see 2.10.x release notes.
• Added Single Logout for OIDC in Jira Service Management.

• SAML Single Sign-On 6.6.0 comes with the User Sync 2.9.0 release, see 2.9.x release notes.
• Added WebSudo support for OIDC.
• WebSudo: forceAuthentication can now be deactivated.
• Fixed: the Linchpin endpoints are no longer accessed from the frontend when not running on Confluence.

• SAML Single Sign-On 6.6.0 comes with the User Sync 2.9.0 release, see 2.9.x release notes.
• Added WebSudo support for OIDC.
• WebSudo: forceAuthentication can now be deactivated.
• Fixed: the Linchpin endpoints are no longer accessed from the frontend when not running on Confluence.

• This version includes a bugfix in User Sync 2.8.1, see 2.8.x release notes.

• This version includes a bugfix in User Sync 2.8.1, see 2.8.x release notes.

• SAML Single Sign-On 6.5.0 comes with the User Sync 2.8.0 release, see 2.8.x release notes.
• Added Relying Party Initiated Single Logout for OIDC: Logout from your identity provider and other connected services when logging out from your Atlassian product.
• Added optional IdP selection buttons on login page: Click a button to login via SSO as an alternative to using the redirection.
• Added "auth_fallback" as an additional nosso parameter.
• Added option to sign Single Logout responses.

• SAML Single Sign-On 6.5.0 comes with the User Sync 2.8.0 release, see 2.8.x release notes.
• Added Relying Party Initiated Single Logout for OIDC: Logout from your identity provider and other connected services when logging out from your Atlassian product.
• Added optional IdP selection buttons on login page: Click a button to login via SSO as an alternative to using the redirection.
• Added "auth_fallback" as an additional nosso parameter.
• Added option to sign Single Logout responses.

• SAML Single Sign-On 6.4.0 comes with the User Sync 2.7.1 release, see 2.7.x release notes.
• Added preset for OIDC with Ping One.
• Fixed logout issues when using OIDC.
• Fixed flickering authentication tracker UI for OIDC logins.
• Allow sending SAML authentication requests to a different URLs.
• Added metadata file import to the IdP page.

• SAML Single Sign-On 6.4.0 comes with the User Sync 2.7.1 release, see 2.7.x release notes.
• Added preset for OIDC with Ping One.
• Fixed logout issues when using OIDC.
• Fixed flickering authentication tracker UI for OIDC logins.
• Allow sending SAML authentication requests to a different URLs.
• Added metadata file import to the IdP page.

• Allow OAuth2 authentication with Atlassian, LinkedIn, GitHub, Twitter or Facebook
• Specific SP metadata can be provided per IdP
• User Sync now allows synchronizing profile pictures from Azure or G Suite in Jira and Confluence
• Fix a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed .
• Please check our release notes for more details.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

• Allow OAuth2 authentication with Atlassian, LinkedIn, GitHub, Twitter or Facebook
• Specific SP metadata can be provided per IdP
• User Sync now allows synchronizing profile pictures from Azure or G Suite in Jira and Confluence
• Fix a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed .
• Please check our release notes for more details.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.

Fixed a medium level security vulnerability potentially allowing replay attacks, see https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2023-01-12-response-can-be-replayed-with-modified-id-when-only-the-assertion-is-signed.