Atlassian Cloud
Protocol: SAML 2.0 Native feature: Atlassian Guard (formerly Atlassian Access) - organisation-level SAML SSO Estimated time: 20-30 minutes Reference docs: Atlassian - Configure SAML SSO with an identity provider (opens in a new tab) | Understand Atlassian Guard (opens in a new tab)
Atlassian Guard is a paid add-on for Atlassian Cloud organisations. It applies SAML SSO to the entire Atlassian organisation (Jira, Confluence, and other products). You cannot apply SAML SSO to a single product only.
Prerequisites
- Atlassian Cloud organisation with Atlassian Guard enabled
- Organisation admin access at
admin.atlassian.com - LuxID SAML metadata XML imported (production or UAT)
- Your Atlassian organisation's ACS URL and Entity ID to provide to LuxID
Step 1 - locate the SAML configuration
Go to https://admin.atlassian.com (opens in a new tab) and select your organisation.
Navigate to Security > SAML single sign-on and click Add SAML configuration.
Step 2 - gather your Atlassian SP details
Before configuring SAML, copy your Atlassian SP values to share with LuxID:
| Atlassian field | Your value (example) |
|---|---|
| Entity ID (Audience URI) | https://auth.atlassian.com/saml/... - shown in the SAML config screen |
| Assertion Consumer Service URL | https://auth.atlassian.com/login/callback?connection=... - shown in the config screen |
Send these values to LuxID so LuxID can configure the Relying Party trust on the LuxID side.
Step 3 - import LuxID IdP metadata into Atlassian
In the Atlassian SAML configuration screen:
- Select Use metadata URL or Upload metadata file
- Paste the LuxID production metadata URL:
https://docs.luxid.lu/saml/luxid_idp_saml_metadata-prod.xml - Atlassian will auto-populate the IdP Entity ID, SSO URL, and certificate
Alternatively, download the metadata XML and upload it as a file.
Resulting field values (verify these after import)
| Atlassian field | Expected value after import |
|---|---|
| Identity provider Entity ID | https://login.luxid.lu/saml/sps/saml20idp-LUXID/saml20 |
| Identity provider SSO URL | From metadata XML |
| Public x509 certificate | From metadata XML |
Step 4 - attribute mapping
In Atlassian Guard, configure the attribute mapping:
| Atlassian attribute | SAML attribute from LuxID |
|---|---|
| Email address | email |
| Display name | name (or map given_name + family_name separately if available) |
Atlassian uses email address as the user identifier. Confirm that the email claim is included in your LuxID Claim Template.
Step 5 - test login
- Use the LuxID UAT metadata URL instead:
https://docs.luxid.lu/saml/luxid_idp_saml_metadata-uat.xml - Verify the LuxID UAT ACS URL is also registered with LuxID for sandbox testing
- In an incognito window, navigate to
https://id.atlassian.comand sign in with a managed email domain - You should be redirected to
login-uat.luxid.lufor authentication - Complete authentication and verify return to Atlassian
Step 6 - production checklist and common errors
Production checklist
- Restore the production metadata URL
- Confirm verified domains in Atlassian Guard match your organisation's email domain
- Test with a real LuxID Account and a managed Atlassian user
- Confirm fallback access for Atlassian admins (Atlassian recommends keeping one admin account outside SAML enforcement)
Common errors
| Error | Cause | Fix |
|---|---|---|
Response is missing an assertion | SAML assertion not signed with expected key | Re-import metadata to refresh the certificate |
| User not in managed domain | Email domain not verified in Atlassian Guard | Verify the domain at admin.atlassian.com > Domains |
| Redirect loop | ACS URL mismatch | Confirm ACS URL with LuxID team matches the Atlassian-provided URL |
| SSO not triggered for some users | User email domain not managed | All users must use the verified email domain for SAML to apply |