SWA Migration: Jira Cloud and Confluence Cloud Migration to Atlassian Account Skip to main content
https://support.okta.com/help/oktaarticledetailpage?childcateg=&id=ka02a000000xakssa0&source=documentation&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fdocumentation%2fknowledge_article%2fswa-migration-jira-cloud-and-confluence-cloud-migration-to-atlassian-account
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Average Rating:
SWA Migration: Jira Cloud and Confluence Cloud Migration to Atlassian Account
Published: Mar 6, 2017   -   Updated: Apr 22, 2017

Contents


Notes

  • Once you migrate to Atlassian Account, you will use the Atlassian Account email address and password to log in to Jira Cloud, Confluence Cloud, and BitBucket.

  • If you use BitBucket, you already have an Atlassian Account. In case you have to reset your password during this migration, make sure that you update the BitBucket app with the new Atlassian Account password.


Before You Migrate

  • The email address becomes the unique identifier for login after migration to Atlassian account. Users will no longer be able to use their JIRA and Confluence Cloud usernames to login.

  • If you have multiple Atlassian tenants, such as https://company1.atlassian.net for JIRA, and https://company2.atlassian.net for Confluence, ensure that end-users have the same email address in all of the Atlassian tenants that you're migrating.

  • You may be required to switch to the new Atlassian Cloud integration for SWA SSO. See Do I need to switch to the new Atlassian Cloud integration to continue using SWA SSO? to determine whether you need to switch to the new app.

  • If you're using the JIRA and Confluence provisioning integration:

    • Important: Atlassian will no longer support the ability to push profile updates (Update User Attributes feature), including all user attributes previously supported, and sync passwords (Sync Password feature) for users once you migrate to Atlassian Account.

      Atlassian reports working towards SCIM support for their applications which should enable this functionality again, and is targeting completion in July 2017 (see https://jira.atlassian.com/browse/ID-6305). Please contact Atlassian Support for more specific updates on the status of this project.

      In the meantime, we recommend that you turn off Sync Password functionality in Okta under the Provisioning tab for existing Jira and Confluence integrations. The rest of provisioning (create users, deactivate users, groups push and group assignments) will continue to work. In order for groups push and groups assignments to continue to work, you need to make sure the Update User Attributes feature is enabled (under the Provisioning tab).

    • For API authentication under the Provisioning tab, keep the following in mind when migrating to Atlassian Account: 

      • For Jira Cloud: Once you migrate to Atlassian Account, you will need use the API user's Jira Cloud username/email address and Atlassian Account password. (If this user's password was changed during the migration process, then you need to update the password under the Provisioning tab to avoid breaking provisioning).

      • For Confluence Cloud: Once you migrate to Atlassian Account, you will need use the API user's Confluence Cloud username and Atlassian Account password. (If this user's password was changed during the migration process, then you need to update the password under the Provisioning tab to avoid breaking provisioning).


Do I need to switch to the new Atlassian Cloud integration to continue using SWA SSO?

Depending on how your current JIRA and Confluence Cloud SWA app integrations are set up (regardless of whether provisioning is enabled or not), you may be able to continue using the same application to sign in If your set-up satisfies all of the following criteria. Otherwise, you'll need to switch to the Atlassian Cloud integration to continue using SWA SSO mode to signin to Atlassian Account.

Criteria:

  1. You have only one Atlassian Cloud tenant (not separate tenants for JIRA and Confluence).

  2. The username value (app.Username) for login to this Atlassian Cloud tenant is currently set to be identical to the user's email address. In other words, you need to ensure that all users assigned to the current SWA apps have their valid email addresses set as their SWA app username. This is because once you migrate to Atlassian Account, users will be required to use their email address to log in. A Jira and Confluence Cloud username that is different from the email address will no longer work.

Note: If you're using provisioning, do not change the profile mappings to try to meet the above criteria. It will cause errors, and users may get locked out.

Next, follow the links below for next steps based on whether you meet the criteria or not:


Migrate me to Atlassian Account using Existing Jira and Confluence Cloud SWA App Integrations.

Before attempting the steps below, please go over the entire flow and plan your migration project accordingly. There will be some downtime for end users, so it is best to schedule a day and time for the migration, and letting your end-users know in advance.

If you use Provisioning:

Go to the JIRA and Confluence provisioning integrations and turn off Sync Password.

Check whether you are using the API user's username to authenticate in the Provisioning tab. If yes, you will need to update the username to the user's email address once you turn on Atlassian Account in your Atlassian tenant(s) provisioning is connecting to.

Change your Sign On Settings for SWA:

You need to allow end-users to set their passwords. This is because you will no longer be able to use Sync Password and therefore will not be able to manage passwords through Okta.

  1. Login to your Okta Org as an administrator.

  2. Navigate to your Jira/Confluence app.

  3. Select the Sign On tab, then select Administrator sets username, user sets password option.

    User-added image

  4. Save your settings.

Migrate to Atlassian Account

  1. Log in as an administrator to your Atlassian tenant (JIRA or Confluence).

  2. Navigate to Site Administration > User Management.

    User-added image

  3. Navigate to Authentication > Atlassian account:

    User-added image

  4. Turn on the Enable Atlassian account checkbox.

After you Migrate: End-user steps

After you migrate to an Atlassian account, your end-users will follow a simple verification process. The first attempt to login via the JIRA or Confluence SWA chiclet will look like the one shown in the following example:

User-added image

Since you have only one Atlassian tenant for both JIRA and Confluence, the assumption is that both your JIRA and Confluence SWA chiclets will have identical passwords stored in Okta. If however, this is not the case, then the end-user's Atlassian Account password will be set to the one stored in the first chiclet the end-user clicks on to kick off the Atlassian Account verification process. Your end users will have the ability to optionally reset their Atlassian Account password in case they experience issues. Once they set a new password, they will have to manually update it in Okta.

If some of your end-users already have an Atlassian Account with the same email address, the above flow may fail for them. This is because the Atlassian Account password they set up in the past may not match the password Okta has stored for JIRA and Confluence. If they do not remember their password, they can reset their password. Once they set a new password, they will have to manually update it in Okta. Note that if you use and your end-users use BitBucket, you already have an Atlassian Account as BitBucket has fully migrated to Atlassian Account.


Migrate me to Atlassian Account and Switch me to the New Atlassian Cloud SWA App Integration

​Before attempting the steps below, go over the entire flow and plan your migration project accordingly. There will be some down-time for end users, so it is best to schedule a day and time for the migration, and letting your end-users know in advance.

If you use Provisioning:

Go to the JIRA and Confluence provisioning integrations and turn off Sync Password.

Check whether you are using the API user's username to authenticate in the provisioning tab. If yes, you will need to update the username to the user's email address once you turn on Atlassian Account in your Atlassian tenant(s) provisioning is connecting to.

Identify one or more group(s) in Okta which collectively have all your users assigned to your current JIRA and Confluence integrations.

Because you will be switching to a new integration, identify the groups assigned to your existing JIRA and Confluence integrations. It is easier to do group app assignment, rather than assigning the new app integration individually.

Important: Since you are now managing two apps, one for provisioning and the other for SSO, you need to assign both apps to new users. You can do this using Group Rules. See here for more information about using Groups and Group Rules.

Find and add the Atlassian Cloud Integration

Note: The Atlassian Cloud app integration has been available in the OAN since March, 2017.

  1. Applications > Add application and add the Atlassian Cloud app integration.

  2. Under the General tab, select both the JIRA and Confluence app links if you wish to SSO into both.

  3. Go to the Sign On tab.

  4. Select the Administrator sets username, user sets password option. You need to allow end-users to set their passwords. This is because you will no longer be able to use Sync Password if you use provisioning, and therefore will not be able to manage passwords through Okta.

    User-added image

  5. Enter your JIRA Cloud base URL in the JIRA Base URL field. For example, https://[customer-name].atlassian.net.

  6. Enter your Confluence Cloud base URL in the Confluence Base URL field. For example, https://[customer-name].atlassian.net/wiki (append /wiki at the end of the URL to land on the Confluence dashboard upon login).

    User-added image

  7. Use email address or Okta username as the Application username format (do not use prefix). Your selection will depend on which field in Okta will match the email address field in the JIRA Cloud and Confluence Cloud tenants for users. Once you switch to Atlassian Account, end users will have to use their email address to log in.

    User-added image

  8. Assign the app integration to the groups and users that need it.

Hide the old JIRA and Confluence SWA app chiclets from end-user Okta dashboard

Now that you have the new Atlassian Cloud SWA app set up and assigned, go ahead and hide the existing JIRA and 0Confluence app chiclets from end-user Okta dashboards to avoid confusion.

To do so:
  1. Open the JIRA and Confluence SWA apps, select the General tab, then click Edit.

  2. Check Do not display application icon to users.

  3. Click Save.

Migrate to Atlassian account

  1. Log in as admin to your Atlassian tenant (JIRA or Confluence).

  2. Navigate to Site Administration > User management:

    User-added image

  3. Navigate to Authentication > Atlassian account:

    User-added image
     

  4. Turn on Enable Atlassian account checkbox.

After you migrate: End-user steps

In the following instructions, you refers to the end-user.

After your Okta admins have assigned you the new Atlassian Cloud app (new chiclets), you have to follow a simple verification process.

First of all you need to click on the chiclet, it will ask you for a password.

User-added image

What do I enter as password? We suggest two flows for setting your password:

  1. Type into the password field your desired password for all your Atlassian apps After saving this password you'll be redirected to the Atlassian ID page, and sign-on will fail. Go ahead and reset your password. You'll receive an email notification with instructions on how to reset your password.

    Set the password to be the same as the one you previously set in the Okta chiclet.

  2. If you know your exact password for your Jira and Confluence accounts, use this password for all chiclets.

    If some of your end-users already have an Atlassian Account with the same email address stored in Jira and Confluence, they can use that password to log in. Note that if you use and your end-users use BitBucket, you already have an Atlassian Account as BitBucket has fully migrated to Atlassian Account. If end-users do not remember the Atlassian Account password they set in the past, they can reset it.

    In this case on first login you'll see a flow like this:

     

    User-added image

If you're able to login to Jira and Confluence, you're all set! Congratulations!

Post a Comment