# Setting Up SAML Single Sign-On in Jira with Keycloak IDP

In the latest Jira products, including Jira Software and Jira Service Management, users can configure their own SAML/OAuth2 Identity Provider (IDP) without needing any plugins or extensions. This guide will help you configure SAML in your Jira application using Keycloak as the SAML IDP.

## 1\. Create Keycloak SAML client as Identity Provider

* Log in to your Keycloak account, select your realm to create your client for Jira authentication
    
* Navigate **Client** → **Create client**
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760439553017/b5f09bcb-27cc-495b-859e-9c8ed3e5d52c.png align="center")
    
* Configure the client with the following required values:
    

| **Key** | **Value** |
| --- | --- |
| Client ID | `https://{jira_host}` |
| Root URL | `https://{jira_host}/` |
| Home URL | `https://{jira_host}/` |
| Valid redirect URIs | `https://{jira_host}/*` |
| IDP-Initiated SSO URL name | `https://{keycloak_host}/realms/master/protocol/saml` |
| Master SAML Processing URL | `https://{jira_host}/plugins/servlet/samlconsumer` |
| Name ID format | email |
| Force name ID format | On |
| Force POST binding | On |
| Include AuthnStatement | On |
| Sign documents | On |
| Sign assertions | On |

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760440065269/1e4dac55-d0b9-4614-901a-dcb3e43b86ca.png align="center")

* Switch to **Key** tab, turn off **Signing keys config**:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760440093157/97869bdb-065d-4499-b623-ea24e53ba1ec.png align="center")
    
* Switch to **Client scopes** tab:
    
    * Change **role\_list** to **Optional** (if your client had). It will prevent [**Attribute element with duplicated Name error**](https://support.atlassian.com/jira/kb/found-an-attribute-element-with-duplicated-name-error-while-users-tries-to-login-using-sso/)
        
    * Choose the dedicated **Assigned client scope** to add new mappers:
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760440507009/34507dce-bf7e-4b21-b70a-56ace2ef3674.png align="center")
        
* Next, config **Group list** and **User Property**:
    
    * Configure a new mapper:
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760440466981/f8d6e1b5-ac9f-43d4-8f32-65693bbca481.png align="center")
        
        * Add `memberOf` as **Group list** to allow Jira to get your member groups:
            
        * Add `firstName` , `lastName` , `email` as **User Property** to allow Jira to get users information
            
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760440586319/36a33ec9-37f4-4bc8-8676-05f22fc3d98f.png align="center")
        
* Switch to **Advanced** tab, config `https://{jira_host}/plugins/servlet/samlconsumer` as **Assertion Consumer Service POST Binding URL** and **Logout Service POST Binding URL:**
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760440661863/2371d585-7ea3-452b-a415-f3db525226dd.png align="center")
    
* Navigate **Realms Setting**, choose **Key** tab, see **RS256** and copy and remember the **Certificate** for next step:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760440776056/3ad58310-844b-460f-909b-17d50d398daa.png align="center")
    

---

# 2\. Config Jira authentication method

The latest Jira products support authentication methods that allow authentication via SAML/OAuth2:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760499579218/e61a4afd-11a8-4e9f-ae56-aed5507197f2.png align="center")

Now, let's configure SAML as Single Sign-On in Jira. I will use Jira Service Management as an example:

1. Access **https://{jira\_host}/plugins/servlet/authentication-config** (change your DNS) or click the top right **gear icon**, choose **System**, navigate **Authentication methods** in left navbar, choose **Add configuration**. Fill the Name and choose **SAML** as **Authentication method**
    
2. Next fill the **Name** and required options for **SAML SSO settings** as table below:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760499956130/2ffc4891-56f6-42ce-8c34-dd24f41eaa66.png align="center")
    

| **Key** | **Value** |
| --- | --- |
| Single sign-on issuer | https://{keycloak\_host}/realms/{realms} |
| Identity provider single sign-on URL | https://{keycloak\_host}/realms/{realms}/protocol/saml |
| X.509 Certificate | Paste certificate which obtain in previous step |
| Username mapping | ${NameID} |
| Name ID Policy | Email Address |
| Sign requests | Off/Uncheck |

3. If you want [JIT](https://confluence.atlassian.com/enterprise/just-in-time-user-provisioning-1005342571.html) to allow users to be created and updated automatically when they log in through SSO to Atlassian Data Center applications, specify as below:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760500359416/324d199a-645b-4a0d-82c1-7f403ae94264.png align="center")

4. Config remain options and click **Save configuration** to finish:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760500431631/666dd1f0-fede-4f7d-9e6a-28bb6866fdb3.png align="center")
    
5. Back to Authentication methods, we have configured SAML:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760500531650/fd758494-3119-4a0c-8ffd-18c32146b3bf.png align="center")
    
6. Click **Action**, **Test sign-in**
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760500529328/683ef1b1-8d35-4aaf-ac71-4168dd33af9a.png align="center")
    
7. Login with your SAML account, and then we accessed Jira:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760500634420/c2962fc0-c11d-4379-a046-8f11ce327380.png align="center")
    

---

You have successfully configured SAML authentication for Jira Service Management using Keycloak as the Identity Provider. This setup will streamline the login process for your Jira applications, making it easier for users to access them.