Atlassian Cloud - user management and SSO for external (not in our org) users and Qlik Sense server
Asked by Jessica Malenfant:

Hi community,

I've been researching the boards, issues, etc. about our problem, but cannot find a solution yet.

Scenario:

* We have an an open source Atlassian license for JIRA and Confluence and have a combination of external and internal users for confluence.
* We do not own the domain / cannot verify a domain in the Organization listed in our Atlassian instance and our users are not part of a single domain or organization
* We need to embed a BI dashboard (Qlik Sense app) into a confluence page (we've done this successfully) **AND** have a mechanism (an identify provider I believe) pass the Atlassian user to the external Qlik Sense server in Azure as SSO so that the user does not need to leave Atlassian or log-in to Qlik separately.

Any guidance is appreciated.

A few links i've found but

<https://confluence.atlassian.com/cloud/user-provisioning-959305316.html>

<https://jira.atlassian.com/browse/ID-79>

<https://developer.atlassian.com/cloud/admin/user-provisioning/rest/>

[https://community.atlassian.com/t5/forums/searchpage/tab/message?advanced=false\&allow_punctuation=false\&q=SSO+for+external+users](https://community.atlassian.com/t5/forums/searchpage/tab/message?advanced=false&allow_punctuation=false&q=SSO+for+external+users)

<https://community.atlassian.com/t5/Atlassian-Access-questions/Atlassian-Access-External-Users-that-are-not-part-of-our-domain/qaq-p/863314>


Answers:
author: Daniel Eads
body: Hey Jessica,

This is an interesting problem and you're not alone in wanting to do something like this. The tricky bit is that Confluence doesn't act as an identity provider (this is where Atlassian Access/Okta/Azure SSO come in) so there's no clean solution to hand a Confluence user to another system.

In the past, I've seen people use an iFrame to embed the content from their BI system and use an embedded username/password in the iFrame. Depending on your BI solution, this might violate your user agreement. It's also not particularly secure, as the most adept among your users could intercept the "shared" username/password.

Given the pieces you laid out, there doesn't seem to be a great solution. If possible, I'd try to take screenshots or copy any images you need from the BI tool and paste them directly into the page on Confluence. The downsides of this are that you don't get any interactivity with charts/filtering you might want to do, and these screenshots would need to be updated regularly. Alternatively, you can see if there's a way in your BI tool to embed particular charts without authentication (public access). The [HTML macro for Confluence add-on for Cloud](https://marketplace.atlassian.com/apps/1212279/html-macro-for-confluence-cloud?hosting=cloud&tab=overview) can help with embedding some of this content if you haven't already checked that add-on out.

Cheers,  
Daniel

comments: author: Jessica Malenfant
body: Hi [@Daniel Eads](/t5/user/viewprofilepage/user-id/1527694) - thanks for your note. This seems like it should be such a straightforward solution to this seemingly common situation. Since we don't own the domain and have Atlassian users from many organizations, it sounds like we can't use Okta or another identity provider, to hand a confluence user to another system.   
Is it possible to somehow write a script that can pull user credentials that passes those to our BI tool Qlik?


Tags: cloud

jira

okta

qlik

saml

sso

user-management