• Fixed login redirection for URLs containing special characters.
• Fixed pagination in authentication tracker list.
• This update includes the bugfix release of User Sync 1.9.6.

• Fixed login redirection for URLs containing special characters.
• Fixed pagination in authentication tracker list.
• This update includes the bugfix release of User Sync 1.9.6.

• Fixed failing base URL check for absolute URLs.
• This update includes the bugfix release of User Sync 1.9.5.

• Fixed failing base URL check for absolute URLs.
• This update includes the bugfix release of User Sync 1.9.5.

• Fixed bug in Just-in-Time Provisioning: groups are no longer created if option “Create groups if they do not exist” is disabled.
• This update includes the bugfix release of User Sync 1.9.4.

• Fixed bug in Just-in-Time Provisioning: groups are no longer created if option “Create groups if they do not exist” is disabled.
• This update includes the bugfix release of User Sync 1.9.4.

• Fixed possible redirection vulnerability in samlsso servlet and WebSudo servlet.
• Fixed metadata import when metadata only contains a REDIRECT login binding.
• Fixed tester for “E-Mail Domains”
• This update includes the bugfix release of User Sync 1.9.3.

• Fixed possible redirection vulnerability in samlsso servlet and WebSudo servlet.
• Fixed metadata import when metadata only contains a REDIRECT login binding.
• Fixed tester for “E-Mail Domains”
• This update includes the bugfix release of User Sync 1.9.3.

• Fixed: login will no longer fail if User Sync lookup fails.
• Fixed: automatic metadata refresh no longer leads to invalid configuration.
• Fixed: refresh tracker button now working again.
• Fixed duplicate X-XSS-Protection headers in samlsso servlet.
• Added X-Content-Type-Options header to samlsso servlet.
• This update includes the bugfix release of User Sync 1.9.2.

• Fixed: login will no longer fail if User Sync lookup fails.
• Fixed: automatic metadata refresh no longer leads to invalid configuration.
• Fixed: refresh tracker button now working again.
• Fixed duplicate X-XSS-Protection headers in samlsso servlet.
• Added X-Content-Type-Options header to samlsso servlet.
• This update includes the bugfix release of User Sync 1.9.2.

• Fixed user reactivation when user exists in multiple directories.
• Fixed: groups are no longer removed from non-SAML-created users.
• Changed order or transformations to recreate the behavior of SAML Single Sign On 3.x.
• Fixed the status of the authentication tracker when the users is updated during login.

• Fixed user reactivation when user exists in multiple directories.
• Fixed: groups are no longer removed from non-SAML-created users.
• Changed order or transformations to recreate the behavior of SAML Single Sign On 3.x.
• Fixed the status of the authentication tracker when the users is updated during login.

Reach 100% accuracy in user & group attribute mapping from your IdP into the Atlassian application!

• Advanced attribute mapping: Map any attributes from the identity provider to local user attributes, including Confluence user profile attributes.
• Configuration presets for common uses cases and identity providers
• New transformations in addition to regular expressions:
  • common transformations as presets (e.g. convert Azure guest users or strip email domains)
  • new transformations such as splitting attribute values by separator
  • custom transformations with Groovy scripts.
• Define custom Attributes like employee ID to search for your users in the Atlassian app.
• Other improvements & bug fixes:
  • Improved Auth Tracker List: ability to search & filter logins, and create a support case in-app
  • Bug Eradicated: Literally one bug eradicated in User & Group Sync 1.9.0
  • Fixed WebSudo with SAML for Chrome & other browsers enforcing new samesite cookie policies

Reach 100% accuracy in user & group attribute mapping from your IdP into the Atlassian application!

• Advanced attribute mapping: Map any attributes from the identity provider to local user attributes, including Confluence user profile attributes.
• Configuration presets for common uses cases and identity providers
• New transformations in addition to regular expressions:
  • common transformations as presets (e.g. convert Azure guest users or strip email domains)
  • new transformations such as splitting attribute values by separator
  • custom transformations with Groovy scripts.
• Define custom Attributes like employee ID to search for your users in the Atlassian app.
• Other improvements & bug fixes:
  • Improved Auth Tracker List: ability to search & filter logins, and create a support case in-app
  • Bug Eradicated: Literally one bug eradicated in User & Group Sync 1.9.0
  • Fixed WebSudo with SAML for Chrome & other browsers enforcing new samesite cookie policies

• Fixed possible open redirect vulnerability (minor severity) in logged out page template.
• Added documentation for WebSudo usage, check this knowledge base article for more information.
• This update includes the bugfix release of User Sync 1.5.4.

• Fixed possible open redirect vulnerability (minor severity) in logged out page template.
• Added documentation for WebSudo usage, check this knowledge base article for more information.
• This update includes the bugfix release of User Sync 1.5.4.

• Fixed possible path traversal vulnerability in SSO redirection.
• Added additional default non-SSO user agents for Microsoft Office.
• This update includes the bugfix release of User Sync 1.5.3.

• Fixed possible path traversal vulnerability in SSO redirection.
• Added additional default non-SSO user agents for Microsoft Office.
• This update includes the bugfix release of User Sync 1.5.3.

• Fixed possbile XXE vulnerability in a REST endpoint that is only accessible with SYSADMIN privileges.
• Updated AngularJS.
• This update includes the bugfix release of User Sync 1.5.2.

• Fixed possbile XXE vulnerability in a REST endpoint that is only accessible with SYSADMIN privileges.
• Updated AngularJS.
• This update includes the bugfix release of User Sync 1.5.2.

• Provides an API allowing other plugins to use SAML for additional authentication (e.g. for approval processes).
• Allows using a separate response URL for Single Logout responses.
• This update includes the bugfix release of User Sync 1.5.1.

• Provides an API allowing other plugins to use SAML for additional authentication (e.g. for approval processes).
• Allows using a separate response URL for Single Logout responses.
• This update includes the bugfix release of User Sync 1.5.1.

• This update includes the bugfix release of User Sync 1.5.0.
• The error page does no longer contain a stacktrace.

• This update includes the bugfix release of User Sync 1.5.0.
• The error page does no longer contain a stacktrace.

• This update includes the bugfix release of User Sync 1.4.4.
• Fixed possible vulnerability when redirecting to malicious URLs without protocol part.
• Fixed bug where login was not possible when the Issuer is only present in the assertion.
• Fixed bug that prevented the regeneration of the session ID after login.

• This update includes the bugfix release of User Sync 1.4.4.
• Fixed possible vulnerability when redirecting to malicious URLs without protocol part.
• Fixed bug where login was not possible when the Issuer is only present in the assertion.
• Fixed bug that prevented the regeneration of the session ID after login.

This update includes the bugfix release of User Sync 1.4.3.

This update includes the bugfix release of User Sync 1.4.3.

• This update includes the bugfix release of User Sync 1.4.1.
• Added: option to rename users during login when using EMAIL oder ADDITIONALID as authentication attribute. This is optional and needs to be explicitly enabled in the section "User Creation and Update from SAML Attributes".

• This update includes the bugfix release of User Sync 1.4.1.
• Added: option to rename users during login when using EMAIL oder ADDITIONALID as authentication attribute. This is optional and needs to be explicitly enabled in the section "User Creation and Update from SAML Attributes".

• This update includes User Sync 1.4.0.
• Fixed Sign On issues when clicking links from Microsoft Office applications.
• Fixed problem with IdP selection when multiple Atlassian applications are running on the same host.

• This update includes User Sync 1.4.0.
• Fixed Sign On issues when clicking links from Microsoft Office applications.
• Fixed problem with IdP selection when multiple Atlassian applications are running on the same host.

This update includes the bugfix release of User Sync 1.3.1.

This update includes the bugfix release of User Sync 1.3.1.

• Fixed login error related to signing when using Redirect binding.
• Fixed redirection to requested page after login.
• LogoutRequest on IdP initiated Single Logout is now added to authentication tracker.

• Fixed login error related to signing when using Redirect binding.
• Fixed redirection to requested page after login.
• LogoutRequest on IdP initiated Single Logout is now added to authentication tracker.

• This update includes User Sync 1.3.0, which brings the new OneLogin connector, improved G Suite sync and bug fixes.
• Added authentication by additional ID.
• Fixed regular expression matching for IdP selection by request header.
• Fixed possible Host Header Injection vulnerability in SSO redirection.
• Fixed bug where the session cookie was not properly cleared on logout.
• Fixed bug where URLs were truncated during SSO when they contained special characters.
• Fixed bug where log message of a Jira component were printed to Confluence and Bitbucket logs.
• Fixed redirection after Single Logout.
• Fixed bug where log message of a Jira component was printed to the Bitbucket log file.

For more information please visit our wiki.

• This update includes User Sync 1.3.0, which brings the new OneLogin connector, improved G Suite sync and bug fixes.
• Added authentication by additional ID.
• Fixed regular expression matching for IdP selection by request header.
• Fixed possible Host Header Injection vulnerability in SSO redirection.
• Fixed bug where the session cookie was not properly cleared on logout.
• Fixed bug where URLs were truncated during SSO when they contained special characters.
• Fixed bug where log message of a Jira component were printed to Confluence and Bitbucket logs.
• Fixed redirection after Single Logout.
• Fixed bug where log message of a Jira component was printed to the Bitbucket log file.

For more information please visit our wiki.

• This update includes User Sync 1.2.1 which fixes a bug related to retrieving and updating OAuth tokens in the Azure AD and GSuite connector.

• This update includes User Sync 1.2.1 which fixes a bug related to retrieving and updating OAuth tokens in the Azure AD and GSuite connector.

Fixed in 3.3.1:

• Fixed selection of directory for Just In Time User Provisioning in configuration frontend.

Also new in 3.3.0:

• Includes UserSync to synchronize users
• The IdP certificate's validity dates are checked now and there is an option to deny the login if the certificate is no longer valid
• Disabled users are not activated during the user update if "Reactivate inactive users" is not checked
• Fixed wizard to allow importing JSON-files
• Fixed plugin login shown after installation

Fixed in 3.3.1:

• Fixed selection of directory for Just In Time User Provisioning in configuration frontend.

Also new in 3.3.0:

• Includes UserSync to synchronize users
• The IdP certificate's validity dates are checked now and there is an option to deny the login if the certificate is no longer valid
• Disabled users are not activated during the user update if "Reactivate inactive users" is not checked
• Fixed wizard to allow importing JSON-files
• Fixed plugin login shown after installation

• Includes UserSync to synchronize users
• The IdP certificate's validity dates are checked now and there is an option to deny the login if the certificate is no longer valid
• Disabled users are not activated during the user update if "Reactivate inactive users" is not checked
• Fixed wizard to allow importing JSON-files
• Fixed plugin login shown after installation

• Includes UserSync to synchronize users
• The IdP certificate's validity dates are checked now and there is an option to deny the login if the certificate is no longer valid
• Disabled users are not activated during the user update if "Reactivate inactive users" is not checked
• Fixed wizard to allow importing JSON-files
• Fixed plugin login shown after installation

• Fixed redirection for repositories when name contains "login".

• Fixed redirection for repositories when name contains "login".

Some smaller bugfixes when using combined attributes.

Some smaller bugfixes when using combined attributes.

• Single Logout is now considered as stable and no longer experimental.
• Added option to define the AuthenticationContext in the SAML request.
• Set caching headers to fix problems in environments with reverse proxies.
• Improved logging and validation.

Check also our release notes.

• Single Logout is now considered as stable and no longer experimental.
• Added option to define the AuthenticationContext in the SAML request.
• Set caching headers to fix problems in environments with reverse proxies.
• Improved logging and validation.

Check also our release notes.

Besides Bitbucket 6 compatibility, this version is largely identical to 2.4.8. Here are the release highlights from that version:

• Fixed a cross-site scripting vulnerability on the logged out page: 2019-02-12 XSS Vulnerability on Logged Out Page.
• Fixed caching issue with redirects
• Minor bug fixes.

Besides Bitbucket 6 compatibility, this version is largely identical to 2.4.8. Here are the release highlights from that version:

• Fixed a cross-site scripting vulnerability on the logged out page: 2019-02-12 XSS Vulnerability on Logged Out Page.
• Fixed caching issue with redirects
• Minor bug fixes.

• Fixed a cross-site scripting vulnerability on the logged out page: 2019-02-12 XSS Vulnerability on Logged Out Page.
• Fixed caching issue with redirects
• Minor bug fixes.

• Fixed a cross-site scripting vulnerability on the logged out page: 2019-02-12 XSS Vulnerability on Logged Out Page.
• Fixed caching issue with redirects
• Minor bug fixes.

• Fixed decrypting encrypted assertions in special cases.
• Fixed importing metadata on Windows installations.
• Fixed creating authentication trackers on IdP initiated sign on.

Please also see our release notes.

• Fixed decrypting encrypted assertions in special cases.
• Fixed importing metadata on Windows installations.
• Fixed creating authentication trackers on IdP initiated sign on.

Please also see our release notes.

• Updated opensaml3 library to version 3.4.0.
• Fixed "skip untransformed groups".

• Updated opensaml3 library to version 3.4.0.
• Fixed "skip untransformed groups".

• Improved UI/UX in System & Support section. It's now easier to create and export authentication trackers.
• Fixed reading of userid attribute during authentication by email address.
• Fixed a bug where the user creation could be enabled even though the user update was disabled.

• Improved UI/UX in System & Support section. It's now easier to create and export authentication trackers.
• Fixed reading of userid attribute during authentication by email address.
• Fixed a bug where the user creation could be enabled even though the user update was disabled.

• Handle long relay states differently to avoid misleading errors in log.
• Fixed redirection to invalid URLs to avoid misleading errors in log.

• Handle long relay states differently to avoid misleading errors in log.
• Fixed redirection to invalid URLs to avoid misleading errors in log.

• Optionally block password authentication. If this feature is enabled user can no longer login at the default Bitbucket login page unless they are system administrators or members of the group "allow-password-login". Git operations need to be done via SSH.
• Added REST endpoint to reset the Entity ID.
• It's now possible to disable the automatic activation of inactive users during login.
• Force SSO URLs are now respecting the Non-SSO URLs.
• Fixed the selection of the authentication attribute in the wizard.
• Changed log levels in several cases to make the default logging less verbose.
• Fixed duplicate error messages on error page.

See also our release notes.

• Optionally block password authentication. If this feature is enabled user can no longer login at the default Bitbucket login page unless they are system administrators or members of the group "allow-password-login". Git operations need to be done via SSH.
• Added REST endpoint to reset the Entity ID.
• It's now possible to disable the automatic activation of inactive users during login.
• Force SSO URLs are now respecting the Non-SSO URLs.
• Fixed the selection of the authentication attribute in the wizard.
• Changed log levels in several cases to make the default logging less verbose.
• Fixed duplicate error messages on error page.

See also our release notes.

Improved compatibility with Data Center.

See also our release notes.

• Fixed: inactive users can now be activated and updated in the same login.
• Fixed: after logout the user interface now shows the right UI elements.
• Fixed: the user will no longer be redirected to the logout page after logging in again.
• Fixed IdP selection cookie for Internet Explorer 11.

See also our release notes.

• The userid can now composed from multiple attributes.
• "Update users from remote directories" is now disabled by default in new installations. Existing configurations are not affected by this change.
• Fixed server error when wrong Post Binding URL is configured.
• Fixed server error when "Find user by email" is activated and multiple users with the same email address were found during login.

See also our release notes.

• New feature: Regex transformation for users and groups.
• New feature: Authentication tracker change notifications via email.
• Fixed: Force SSO URLs and Non SSO URLs now handle the HTTP parameters correctly.

See also our release notes.

• Support for aggregated metadata. Metadata from multiple IdPs can now be imported in a single step.
• Support for multiple base urls.
• Fixed migration from older configuration versions. Single Logout is now disabled by default and needs to be enabled explicitly.
• Fixed a bug that could throw a system error on logout.
• Clarified the log message for signature verification.

• Single Logout (experimental) Read more about this feature here. Under certain circumstances, it can happen that the parameter Logout Binding is set to POST or REDIRECT. Please check this value for any configured IdP and set it to DISABLED unless you explicitly want to enable single logout.
• Find user by Email. Ability to match the UserID IdP attribute against email instead of username.
• Ability to disable the "nosso" login parameter. This is generally not recommended, but may be necessary for compliance reasons. If you can't access the config page afterwards, your can read in our documentation how to reenable the nosso login.
• Ability to disable user creation while keeping user update active.
• Fixed group assignment with mixed lowercase/uppercase group names.
• Fixed ArrayIndexOutOfBoundsException while creating RequestInfo JSON.
• Fixed error with MySQL that prevented trackers from cleanup.
• Captcha is reset on successful Single Sign On.
• Fixed a bug that prevented REST requests from working.

• Added support for delegated directories in Crowd, this requires an additional Crowd add-on, see our knowledge base article.
• Added option to disable the remote directory lookup feature introduced in 2.0.5.
• Fixed a bug that could cause performance issues in large instances during the periodical cleanup of response IDs.
• The cookie ‘selectedidp’, saving which IdP the user selected last time, is now marked as secure over HTTPS connections. Best-practice improvement.

• Fixed a bug that could cause performance issues in large instances during the periodical cleanup of authentication trackers.

Changes in 2.0.8:

• Fixed a bug that could trigger a logout redirection while executing a REST requests.
• RememberMe cookie is now also available for Bitbucket

• Re-enabled compatibility for Bitbucket 4.2.0 (see https://wiki.resolution.de/go/ssso/updateRemoteDirectory)
• Fixed potential XSS vulnerability with pass-through parameter names

Fixes and improvements in 2.0.5:

• Improved security: Assertion IDs are now persistently stored for a defined amount of time.
• Improved export of SupportInformation for a better troubleshooting experience.
• Fixed compatibility issues with Oracle and Microsoft SQL Server.
• Fixed performance issue on admin page with large amount of groups in system.
• Fixed several issues with connected LDAP and Crowd directories.
• SSO now works with new users from delegated authentication directories.
• Fixed disabling of logout redirection for non-SSO users.
• Fixed rendering error in Error Page Template.

See also our wiki.

Upgrade consideration

We have done very significant Frontend changes in this version, which you will surely appreciate once you get to use it. We also have done an unprecedented amount of Testing/QA. Nevertheless, please make sure you don't do this upgrade lightly & take appropriate testing steps in your environment. If you're using a Datacenter product, please also consider this note on upgrading your installation.

• Reworked User Interface with IdP Setup Wizard
• Easier Troubleshooting with Authentication Process Tracking
• Arbitrary number of certificates can be configured per IdP
• Organization and Contacts in SAML Metadata
• REST-endpoint for enabling/disabling redirection to IdP
• Enhanced IdP selection
• Entity ID is now editable
• Custom Logged Out URL only for SSO Users
• IdP-Id is now immutable, default IdP is specified by a new parameter weight
• and many more

see also our wiki.

• IdP-signature was not recognized when using REDIRECT-binding
• Messages intended for TRACE-level were shown with DEBUG-logging enabled
• Improved error messages when IdP-metadata is invalid
• ProtocolBinding-tag can be omitted in authentication request
• Fixed intermittent authentication-dialogs in mobile view

See also our wiki.

New features

• Option to include NameID Format in SAML Request

Bug fixes and enhancements

• Fixed bug that updating users with system-administrator permissions failed
• Changing the Bitbucket base-URL is reflected in the Plugin's URLs immediately
• Minor configuration page improvements
• Fixed issues with group assignments

• Support for Bitbucket 5
• Bug Fix: Bitbucket login without SSO no longer fails, when user was never authenticated with SSO before.
• Several small bug fixes.