Skip to content

Integrating SailPoint with Atlassian Suite Cloud

Atlassian is a leading product company providing tools for collaboration and service desk. SailPoint's Atlassian Suite Cloud connector supports reading and provisioning of Atlassian users and groups. Use the Atlassian Suite Cloud source to manage Atlassian Suite user accounts. After it is successfully configured, your organization is able to aggregate and provision accounts for Jira users and manage access to other Atlassian Suite products such as Confluence and Jira Service Management by managing memberships of groups having access to the respective products.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of the Atlassian Suite Cloud source.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Atlassian Suite Cloud connector supports the features listed on this page.

Note

Before you can use any feature marked with an asterisk (*), SailPoint must activate the feature for your site.

Account Management

  • Aggregate accounts
  • Add and remove entitlements

  • *Provision accounts

    • Create new accounts

    • Enable and disable managed accounts

      Note

      Accounts must be claimed accounts from verified domains. For more information, refer to Claim accounts and Verified domains in your organization in the Atlassian documentation. Atlassian documentation is not managed by SailPoint and is subject to change without notice.

  • *Access Certifications (certification of entitlements connected to accounts)

  • Multiple Group Objects and Direct Permissions
  • Delete Accounts

For more information on features, refer to Source Features.

The following table lists the account feature details:

Feature Users
Aggregate ✔
Create ✔
Group Entitlements (Read, Request, Revoke) Groups and Project Roles
Enable Direct Permissions ✔

Group Entitlements

Group Entitlements enable SailPoint to aggregate additional details from the managed system. These objects have a separate schema attribute definition list that the aggregation fetches when aggregation is run for that Group Entitlement type.

The following table lists the group feature details:

Feature Groups Project Roles
Aggregation ✔ ✔

Note

We recommend not updating the group name, as the connector uses the name as the identityAttribute in the group schema. Changing the group name will cause the entitlement to be recreated and the old entitlement will be deleted.

Supported Managed Systems

The SailPoint Atlassian Suite Cloud connector supports the following Atlassian products:

  • Jira Software (Cloud)
  • Jira Service Management
  • Opsgenie
  • Statuspage
  • Confluence

Note

The Jira Administrator can manage the Default Access group associated with different products. Users created from SailPoint are automatically assigned to the default Product Access Groups enabled on the managed system.

Prerequisites

  • Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.

    • Network Requirements

      Outbound access for port 443 (HTTPS) from the VA

  • Whitelist the following URL on the VAs:

    https://<domain>.atlassian.net where <domain> is the domain name configured by the customer.

    https://api.atlassian.com

  • The client is authorized using basic authentication which uses a Site Admin API Token. The token is encoded, and it is generated by user account with Site Admin access. It is added to headers for API requests.

    For more information on generating Site Admin API tokens, refer to Manage API tokens for your Atlassian account in the Atlassian documentation.

    Note

    Atlassian API tokens don't use selectable scopes like OAuth scopes. They inherit the creator's Atlassian roles, so use an account with the required admin role when creating the token. Create the API token without a scope. The linked document is not maintained by SailPoint and is subject to change without notice.

    Screenshot

    API Tokens

  • Enabling or disabling accounts uses token authentication. It needs an Org Admin API Token generated by a user with Org and Site Admin access.

    For more information on generating API tokens, refer to Manage an organization with the admin APIs in the Atlassian documentation.

    Note

    Atlassian API tokens don't use selectable scopes like OAuth scopes. They inherit the creator's Atlassian roles, so use an account with the required admin role when creating the token. Create the API token without a scope.

    Screenshot

    API key without scopes selection

For Service Account Authentication

  • The client is authorized using the email address of an Atlassian service account and a Service Account API Token. Use a scoped API token generated for a service account that has Jira product access and the required permissions. The token must include these classic scopes:

    • read:jira-work
    • read:jira-user
    • manage:jira-configuration
    • manage:jira-project

    For more information, refer to Manage API tokens for service accounts.

Required Permissions

  • The service account must be a Site Admin User (Site Admin/ jira-administrators) with an API token created on the Atlassian Suite managed target system.

  • To support enabling and disabling accounts, the service account must be a Org and Site Admin User with an Org Admin API token created on the Atlassian Suite managed target system.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.