---
title: "SSO 3.X - Configuring SAML SSO Consumer"
canonical: "https://support.appfire.com/space/SSO/18153562/SSO%203.X%20-%20Configuring%20SAML%20SSO%20Consumer"
format: markdown
---
> Macro (aura-html)

Starting with Global SSO 3.0 version there is no need for complicated configuration and troubleshooting sessions as SAML SSO Consumer configuration is now possible with a one click button by using Metadata support. For previous versions please see the documentation .

> ⚠️ To configure settings for Global SSO app, you must have Admin permissions.

> ℹ️ SAML SSO Consumer is configured in the same way for all your Atlassian applications - Jira, Confluence, Bamboo, Fecru.


To prepare and configure SAML SSO Consumer, perform the following operations:

1. For versions 2.0.0-2.2.1, [1. Generating a public/private key pair](#SSO3.X-ConfiguringSAMLSSOConsumer-1.Generatingapublic/privatekeypair). For versions 2.2.2 and above - skip this step.
2. In case when you have a not base 64 encripted X509 certificate, [2. Converting the certificate from IDP to base64 string](#SSO3.X-ConfiguringSAMLSSOConsumer-2.ConvertingthecertificatefromIDPtobase64string).
3. [3. Configuring SAML SSO Consumer](#SSO3.X-ConfiguringSAMLSSOConsumer-3.ConfiguringSAMLSSOConsumer).

## 1. Generating a public/private key pair

> ⚠️ This step is necessary if you are using Global SSO 2.2.0-2.2.1. Skip this step if you are configuring Global SSO 2.2.2 and above.


To generate a public/private key pair, execute the following commands in the Linux console:

1. openssl genrsa -out mykey.pem 2048
2. openssl pkcs8 -topk8 -inform PEM -outform PEM -in mykey.pem -out **private_key.pem** -nocrypt
3. openssl rsa -in mykey.pem -pubout -outform DER -out **public_key.der **

## 2. Converting the certificate from IDP to base64 string

<span style="color: #333333">In openssl, the base64 line length is limited to 76 characters by default. To decode a base64 line without a line feed that exceeds the 76 characters, use the </span>**<span style="color: #333333">-A</span>**<span style="color: #333333"> option:</span>  
openssl enc -base64 -A -in Example.cer -out finalBase64.ser

And then put this certificate in the **../SAMLssoclient/WEB-INF/classes/** directory.

## 3. Configuring SAML SSO Consumer

Starting with Global SSO 3.0 version there is no need for complicated configuration and troubleshooting sessions as SAML SSO Consumer configuration is now possible with a one click button by using Metadata support.

1. Log into your Atlassian Application as Admin.
2. In the cog wheel menu, select **Apps**.
3. Click **SAML Consumer Configuration** section.
4. Upload the Metadata information from the IDP on the **General** tab and put the **Secret Phrase**.
5. Click **Parse settings from metadata**.
6. All the fields are filled out automatically in the **Advanced Setup** tab. For field descriptions, see the [Fields description for SAML Consumer configuration](#SSO3.X-ConfiguringSAMLSSOConsumer-FieldsdescriptionforSAMLConsumerconfiguration).
7. Go to **Global SSO Settings. **The fields are filled out automatically as well.
8. Now, let's test SSO configuration. Go to **Test SSO **tab and click **Send test SAML request to IDP**.   
  
> Macro (inline-media-image)
9. You'll receive the SAML response with the necessary attributes. Here you can also map the username to  the SAML attributes.
  > Macro (inline-media-image)

> Macro (inline-media-image)
10. If you set up the certificate tha has expired or the audience was wrong by clicking **Send test SAML request to IDP **you can easily troubleshoot your configuration.
  > Macro (inline-media-image)

> Macro (inline-media-image)
  That's it. You're all set. SAML Consumer is configured in the same way for all your Atlassian applications.

## Fields description for SAML Consumer configuration

> ⚠️ During IDP configuration, your IDP should send SAML assertions to the endpoint with the following pattern:
> ⚠️ 
> ⚠️ **http://${**[**your-domain.com**](http://your-domain.com)**}/${atlassian-application-path}/plugins/servlet/globalconsumer**


| **Name**  
**(admin page)** | **Description** | **Example** |
| --- | --- | --- |
| IDP Server URL | <span style="color: #292c33">Identity (IDP) provider URL</span> | <span style="color: #000000">Azure: https://login.windows.net/e9ddfgdfgfdgfdh21387-43f1-4e0wewwe6-fea253-f9fefed9096dc48/saml2</span> |
| Assertion Consumer Service URL | <span style="color: #333333">At this step for SAML connections, you specify a URL where IDP should send assertions. Then, SAML Consumer will use these assertions at this URL and process them.</span><br><span style="color: #333333">This URL is built according to the pattern mentioned in the example.</span> | https://${your-atlassian-application}/plugins/servlet/globalconsumer |
| Issuer Application URL | Enter the Issuer Application URL to be used in the SAML response. This is usually same URL as the Assertion Consumer Service URL. | <span style="color: #000000">https://${your-atlassian-application}/plugins/servlet/globalconsumer</span> |
| Audience | Attribute inside SAML assertion which is also checked to validate whether the assertion is acceptable. |  |
| Cookie Domain | Your server domain | If you used such domains as [jira.test.com](http://jira.test.com) and [confluence.test.com](http://confluence.test.com) for instance, you should use "[test.com](http://test.com)" or ".[test.com](http://test.com)". This depends on which Tomcat box version you have with your application. Different Tomcat versions use different cookie generators.<br>If you use the latest Tomcat version, be sure to set the domain names without a leading dot in the name both in the Tomcat configuration and in SAML SSO Consumer configuration as well.<br>See Tomcat documentation for more information. |
| Cookie Path | <span style="color: #333333">It is recommended to use a common path for all applications but if necessary, you can configure SSO between tools separately. This path will be used to generate a cookie for each application.</span> | <span style="color: #000000">"/" </span><br><span style="color: #000000">But you can also use path like "/mypath".</span> |
| Name Attribute | <span style="color: #000000">Attribute name which should be used for the username encoding and then put into an SSO cookie. This attribute should be in a SAML Assertion.</span> | <span style="color: #333333">http://schemas.xm</span><span style="color: #000000">lsoap.org/ws/2005/05/identity/claims/emailaddress</span><br><span style="color: #000000">or just name of attribute like "email".</span> |
| Secret Phrase | Starting with Global SSO **2.2.2**, we have improved the encryption type for a more comprehensive SSO solution. You can now select your own secret phrase that is encrypted instead of working with the private / public keys. This is not only great from the security standpoint but also simplifies the process of SSO configuration, giving you a simplified SSO process whilst still maintaining the highest security level.<br>This phrase can contain upper and lower case letters from the English alphabet, numbers, and special characters. We recommend that the secret phrase is 25 symbols or longer.<br>Secret phrase must be the same for all SAML configurations across your Atlassian applications. |  |
| Default Target Service | Default target URL where a user should be redirected after successful authentication | <span style="color: #000000">https://${your-atlassian-application}</span><span style="color: #000000">/some-default-link</span> |
| <span style="color: #333333">Unauthorized Page</span> | Specify where unauthorized users should be redirected. | error.html |
| <span style="color: #000000">Error </span>Page | In case a user has a wrong SAML Assertion they should be redirected to this link. | <span style="color: #000000">403.html</span> |
| Use Single Sign-Out | Select this checkbox for improved security. this setting is enabled, then if a user logs out in Jira for instance, the user will automatically be logged out in other tools, thus no additional steps are needed to keep your data safe in case you forgot to check that other browser tab. |  |
| <span style="color: #333333">Public Key</span> | Upload your [1. Generating a public/private key pair](#SSO3.X-ConfiguringSAMLSSOConsumer-1.Generatingapublic/privatekeypair) for encryption | > ❌ Private and public key were deprecated in versions 2.2.2 and above. |
| Private Key | Upload your [1. Generating a public/private key pair](#SSO3.X-ConfiguringSAMLSSOConsumer-1.Generatingapublic/privatekeypair) for encryption | > ❌ Private and public key were deprecated in versions 2.2.2 and above. |
| Certificate | Upload your token sign-in certificate. You export this certificate from your IDP SAML 2.0 configuration.<br>For more details refer to your IDP documentation. | Make sure that you delete the following elements:<br>- Line breaks
- Certificate begin and end lines, they look like this "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" |


# What's next

<span style="color: #222222">You are almost there! On the </span>**<span style="color: #222222">GLOBAL SSO</span>**<span style="color: #222222"> section, click </span>**<span style="color: #222222">Global SSO Settings</span>**<span style="color: #222222"> and proceed with configuring Global SSO app for your applications:</span>

- [<span style="color: #222222">Jira SSO app</span>](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18154050)
- [<span style="color: #222222">Confluence SSO app</span>](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18153905)
- [<span style="color: #222222">Bamboo SSO app</span>](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18153843)
- [<span style="color: #222222">Bitbucket SSO app</span>](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18153928)
- [<span style="color: #222222">FishEye SSO app</span>](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18153703)