Confluence - My Page SSO Configuration Using OIDC - RSA Ready Implementation Guide
2 years ago
This section describes how to integrate Confluence with RSA Cloud Authentication Service using My Page SSO (OIDC).

Configure RSA Cloud Authentication Service

Perform these steps to configure RSA Cloud Authentication Service using My Page SSO (OIDC).
Procedure
  1. Sign into RSA Cloud Administration Console.
  2. Navigate to Applications > Applications Catalog and click Create From Template.image.png
  3. Click Choose Connector Template page, click Select from OIDC.image.png
  4. On the Basic Information page, enter a name for the configuration in the Name field and click Next Step.image.png
  5. Choose your desired Access Policy for this application and click Next Step.image.png
  6. Under Connection Profile, provide the following details:
    1. Specify the Connection URL as follows: https://<organization-name>.atlassian.net/wiki
Note: The <organization-name> is set up during the initial setup or registration process of Atlassian Confluence Cloud. It can typically be managed and updated through the administration settings by authorized administrators.
  1. Authorization Server Issuer URL will be auto populated. This URL is used on the miniOrange configuration to form Authorize Endpoint URL, Token Endpoint URL and User info Endpoint URL.
image.png
  1. Redirect URL will be Oauth Callback URL obtained from the miniOrange configuration. 
image.png
  1. Provide a Client ID.
  2. Select Client Authentication Method as 'CLIENT_SECRET_BASIC'.
  3. Provide a Client Secret or generate one by clicking Generate button.
  4. Provide the scope as 'openid', 'profile', and 'email'. 
image.png
Refer to the Notes section to add the scope.
  1. Click Next Step.
  2. ​​​On Portal Display page, configure the portal display and other settings.
  3. Click Save and Finish.
  4. Click Publish Changes to save your settings. After publishing, your application will be enabled for SSO.

Notes

To add scopes:
  1. Navigate to Access > OIDC Settings > Scopes.
  2. After adding all the desired scopes, click Save Settings.
image.png
image.png
 

Configure miniOrange Identity Broker

miniOrange as an Identity Provider

Perform these steps to configure miniOrange as an Identity Provider:

Procedure
  1. Log in to miniOrange admin console: https://login.xecurify.com/moas/login.
  2. Go to Apps and click + Add Application.
image.png
  1. In Choose Application Type, click Create App under the SAML/WS-FED application type.image.png
  2. Search for and select Atlassian Cloud (SAML) in the list. If it's not available, search for Custom and set up your application through Custom SAML App.image.png
  3. Enter the following values in the respective fields (you will receive these values after completing the Atlassian Cloud configuration).
    1. Custom Application Name: Provide any name.
    2. SP Entity ID or Issuer: You will receive this after configuring Atlassian Access App.
    3. Audience URI: Use the same value as SP Entity ID.
    4. ACS URL: You will receive this after configuring Atlassian Access App.
image.png
  1. Ensure that Sign Response and Sign Assertion are both enabled.
image.png
  1. Select the following values in the corresponding fields:
    1. Name ID: Select E-Mail Address.
    2. NameID Format: Select 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'.
image.png
  1. Click Save.
  2. Once the app is successfully created, select that app and then click Metadata to obtain the app’s metadata.image.png
  3. Since miniOrange is being used as a brokering service, go to Information required to authenticate via external IDPs section, and click Show Metadata Details.image.png
  4. After clicking Show Metadata Details, you will see the metadata details. You will need these details while configuring Atlassian Access App.image.png
 

miniOrange as a Service Provider

Perform these steps to configure miniOrange as a Service Provider:
 
Procedure
  1. Log in to miniOrange admin console: https://login.xecurify.com/moas/login.
  2. From the left navigation bar, select Identity Providers, then click Add Identity Provider.image.png
  3. Select the OAuth 2.0 tab.
  4. Enter the following values:
    1. IDP Name: Select Custom Provider.
    2. IDP Display Name: Choose any name.
    3. OAuth Callback URL: The callback URL obtained here is used in the RSA Cloud Authentication Service configuration.
    4. OAuth Authorize Endpoint: Use the Authorization Server Issuer URL obtained from the RSA Cloud Authentication Service + '/auth'. 
    5. OAuth Access Token Endpoint: Use the Authorization Server Issuer URL obtained from RSA Cloud Authentication Service + '/token'. 
    6. OAuth Get User Info Endpoint: Use the Authorization Server Issuer URL obtained from RSA Cloud Authentication Service + '/userinfo'.
    7. Client ID: Provide the client ID used in the RSA Cloud Authentication Service configuration.
    8. Client Secret: Provide the client secret used in the RSA Cloud Authentication Service configuration.
    9. Grant Type: Select Authorization Code Grant. 
image.png
  1. Ensure that Send client credentials in Header and Send Scope in Token Request both are both enabled.
  2. Provide the Scope as openid profile email.
image.png
  1. Click Save.
 

Configure Atlassian Cloud

Perform these steps to configure Atlassian Cloud:

  1. Log in to Atlassian Cloud admin console: https://admin.atlassian.com/
  2. Select your organization.
image.png
  1. Navigate to the Security tab, select Identity providers from the left sidebar, and then click Choose on the Other provider section.image.png
  2. Enter any name in the Directory name field, then click Add.
image.png
  1. Select Set up SAML single sign-on.
image.png
  1. You will be redirected to the Add SAML details window. You can get these details from the metadata details section after configuring the miniOrange app:
    1. Identity provider Entity ID: This is the Identity provider Entity ID or Issuer obtained from the miniOrange Metadata.
    2. Identity provider SSO URL: This is the SAML Login URL obtained from the miniOrange Metadata.
    3. Public x509 certificate: Use the X.509 certificate obtained from the miniOrange Metadata.
image.png
  1. Click Next.
  2. Copy the displayed Service provider entity URL and Service provider assertion consumer service URL. You will need these details for configuring the miniOrange app.
image.png
  1. To enable Single Sign-On (SSO) for managing user accounts, enter the desired domain name to link it with your identity provider. Click Next, then Save.
image.png
  1. Set up the authentication policies by selecting Authentication policies from the left sidebar, then click Add policy.image.png
  2. Select a directory for your policy and enter the policy name.
  3. Under Single sign-on, check the Enforce single sign-on checkbox.image.png
  4. Click the Members tab and click Add members.
image.png
  1. Enter details and click Add Members. Single Sign On (SSO) will apply only to the added members.image.png
  2. When a user tries to log in to the Atlassian Cloud app, they will be redirected to RSA for authentication through the miniOrange broker.

The configuration is complete.
Return to Confluence - RSA Ready Implementation Guide
 
Don't see what you're looking for?