CASB SAML proxy integration with Forgerock IdP and Atlassian apps (Jira, confluence, bitbucket)
This guide will assist you to setup the SAML proxy integration between Forgerock IdP, Atlassian apps (Jira, confluence, bitbucket) and Skyhigh Cloud Reverse proxy.
Pre-requisites:
1. Skyhigh cloud reverse proxy is enabled for Atlassian apps
2. Functioning IdP with a valid SSL certificate and DNS resolvable hostname
3. Single Sign on working setup without Skyhigh cloud reverse proxy (Atlassian apps and Forgerock IdP direct SSO)
(DO NOT PROCEED IF THE DIRECT CONNECTION BETWEEN FORGEROCK AND ATLASSIAN APP IS NOT WORKING)
Three steps are required to successfully integrate CASB reverse proxy with Forgerock IdP and Atlassian apps
1. Skyhigh Dashboard configuration
2. IdP configuration (changes to be applied on Forgerock IdP SSO configuration)
3. CSP configuration (changes to be applied on Atlassian apps SSO configuration)
Step1: Skyhigh Dashboard configuration steps:
1. Configure a custom app in Skyhigh dashboard and map any one activity using custom app plugin (example: login activity)
2. Go to Service management section and select the name of the custom app.
3. Click on the properties and add the below properties as shown in picture
4. Click setup > continue > Then Edit on configure SAML
5. Upload the Forgerock IdP Signing certificate received from IdP team then Next
6. Upload the SP certificate received from application team (Atlassian)
7. Click Next
8. Download proxy certificate (This will be used in Atlassian app for SAML integration)
Step2: IdP configuration (Forgerock IdP)
1. We need to modify the ACS url with our reverse proxy hostname.
2. We need to modify the entityID value with our reverse proxy hostname.
3. This can be done by modifying the IdP profile xml file on Forgerock IdP configuration.
Ex: Reverseproxy hostname: jira.jiraprod.customertenant.myshn.net
Actual endpoint url (or ACS url):
https://jira.abc.com/jira/plugins/servlet/saml/auth
Modified endpoint url to be changed on IdP (or ACS url):
https://jira.abc.com.jira.jiraprod.customertenant.myshn.net/jira/plugins/servlet/saml/auth?shnsaml
Actual Entity ID:
Modified Entity ID to be changed on IdP:
https://jira.abc.com.jira.jiraprod.customertenant.myshn.net/jira
Same steps can be applied for other Atlassian apps.
Step3: CSP configuration (Atlassian apps):
1. Login in to Atlassian apps and navigate to Single Sign on configuration.
2. We need to update the Single Sign on URL with the proxy hostname.
3. We need to update the IdP certificate with the CASB reverse proxy certificate (downloaded in step1).
Actual single signon url:
https://mylogin.abc.com/am/SSOPOST/metaAlias/customername/idpentityid
Modified single signon url to be updated on CSP:
Ex: Reverseproxy hostname: jira.jiraprod.customertenant.myshn.net
4. Replace the IdP certificate with the proxy certificate.
5. Save the changes.