Integrating SailPoint with Atlassian Data Center

Atlassian is a leading product company providing tools for collaboration and service desk. The SailPoint Atlassian Data Center connector supports reading and provisioning of Atlassian users and groups. Use the Atlassian Data Center source in SailPoint to manage Atlassian Data Center user accounts. After you successfully configure the connector, your organization will be able to aggregate and provision accounts for Jira users and manage access to other Atlassian products such as, Confluence, Jira Service Management, Bitbucket, and Bamboo by managing memberships of groups having access to respective products.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of the Atlassian Data Center connector.

Supported Features

The Atlassian Data Center connector supports the following features:

• Aggregation of accounts
• *Provision the accounts
  • Create
  • Enable and Disable ( Managed accounts only)
  • Delete
• Add and Remove Entitlements
• *Access Certifications (certification of entitlements connected to accounts)
• *Password Management

For more information on features, refer to Source Features.

The Atlassian Data Center connector supports multiple group objects and direct permissions.

The following table provides details on each feature:

Group Entitlements

Group Entitlements are the entitlement types which aggregate additional details of entitlement types from the managed system. These objects have separate schema defining list of attributes that aggregation task fetches as additional details when aggregation is run for that Group Entitlements type.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Prerequisites

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
• A Service account that is a member of the Jira administrators group is required for basic authentication and Personal Access Token authentication.
• All Atlassian products that you want to be managed using this connector must be connected to a single Jira server for centralized user management.
• For Atlassian Data Center version 10.x, a server with SFTP access must be set up to allow connections for transferring files required for account aggregation.

Basic Authentication

The service account is authorized using Basic Authentication, which requires a username and password. It is generated by a user account with Administrator access. A service account that is a member of the Jira administrators group is required for Basic Authentication.

Personal Access Token Authentication

The service account is authorized using Personal Access Token (PAT) authentication. The token is encoded and generated by a user account with Administrator access. It is then added to the headers for API requests.

To enable the Auto Refresh Personal Access Token, the authentication type must be set to Personal Access Token.

Creating a Personal Access Token

1. In Jira, select your profile picture at the top right corner of the screen.
2. Select Profile.
3. Select Personal Access Tokens from the left-hand menu.
4. Select Create Token.
5. Give your new token a name.

SFTP Based Account Aggregation

From Atlassian Data Center version 10.x onwards, the API-based user aggregation method is no longer supported.

To enable account aggregation, an SFTP based setup is required. This requires uploading a CSV file containing user details, extracted from the Atlassian database to the SFTP server.

Steps for File Based Account Aggregation (Data Center 10.X Onwards Only)

1. Set Up a SFTP host.
2. Create an Access-Controlled Folder.

3. Extract User Details from Atlassian Data Center's Database.

   Note

   The Extracted file must have user_name, display_name, email_address, active. The column names must match these exactly to work correctly.

4. Use the following MySQL query to extract the required user details:

   SELECT  'user_name' , 'display_name', 'email_address', 'active'
   UNION ALL 
   SELECT u.user_name, u.display_name, u.email_address, 
    CASE 
          WHEN u.active = 1 THEN 1
           WHEN u.active = 0 THEN 0
           WHEN u.active = 'Active' THEN 1
           WHEN u.active = 'Inactive' THEN 0
    END AS active 
   FROM cwd_user u 
   JOIN cwd_directory d ON u.directory_id = d.id  
   INTO OUTFILE '<Absolute Path of above created folder>/<FileName>.csv'
   FIELDS TERMINATED BY ',' 
   ENCLOSED BY '"' 
   LINES TERMINATED BY '\n';
   

5. Configure the file path and SFTP Connection Credentials in Aggregation Settings.

Required Permissions

To manage certain features in the source, set permissions in the following list.

• The service account must be a Super Admin User (Site Admin/Jira-administrators) with an API Token created on the target managed system.
• The service account must have the required permissions to access the host via SFTP to retrieve the CSV file containing user details. If the use of a service account is not preferred, an alternative user account with the necessary permissions can be created.

Supported Managed Systems

The Atlassian Data Center connector supports the following Atlassian products:

• Atlassian Jira Service Management: 10.3.1
• Jira Software: 10.3.4
• Confluence: 9.2.0
• Bamboo: 10.2.3
• Bitbucket: 9.4.5

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.