Set up an Atlassian connector

Capabilities

This connector can provision roles in Atlassian workspaces. Depending on your Atlassian implementation, not all roles may be available for all workspaces, and some roles can be only configured if the user meets certain requirements. The Atlassian connector is unable to predict whether a role will be available to a user before the role is requested, but the connector will show an error if a requested role cannot be provisioned.

Gather Atlassian credentials

Each setup method requires you to pass in credentials generated in Atlassian. Gather these credentials before you move on.

A user with the Org admin role in Atlassian must perform this task.

Create an organization API access token

1. Log into your Atlassian account and select your organization, if relevant.

2. Navigate to Settings > API keys.

3. Click Create API key.

4. Select API key without scopes, then click Create API key.

5. Review the key info and click Create. The new organization API key is generated.

6. Carefully copy and save the API key.

Look up your organization ID

1. Navigate to https://admin.atlassian.com.

2. If you have multiple organizations, select the one you want to look up.

3. In the URL in the browser’s address bar, you’ll find the organization ID after /o/, as in https://admin.atlassian.com/o/<your_organization_id>/overview.

Optional: Request endpoints for provisioning support

If you want to provision workspace roles with the connector, you must raise an Atlassian Support ticket asking the Atlassian team to enable certain necessary endpoints on your tenant.

1. In the Atlassian Support Portal, log into your admin account for the organization you’re connecting and select Contact.

2. Make the following selections when prompted:

• What can we help you with?: Technical issues and bugs
• Which product is this for?: Select a cloud product you use, such as a JIRA instance

1. Click Raise a support request, and add your email to the “Include admin or billing/technical/end-customer contact, or additional participants on this ticket” field.

2. In the Summarize your issue box, enter:

I need access to three Atlassian Administration Cloud API endpoints. The documentation states that access should be requested from the support team.

6. From the What is the impact to your business? drop-down, select Level 3.

7. In the Give us more details section, enter the following, replacing “<ATLASSIAN_ORGANIZATION_ID>” with your Organization ID:

   I need access to the following endpoints of the Atlassian Administration Cloud API:
   
   * Grant User Access: https://developer.atlassian.com/cloud/admin/organization/rest/api-group-directory/\#api-v1-orgs-orgid-users-userid-roles-assign-post
   * Revoke User Access: https://developer.atlassian.com/cloud/admin/organization/rest/api-group-directory/\#api-v1-orgs-orgid-users-userid-roles-revoke-post
   * Invite User to Org: https://developer.atlassian.com/cloud/admin/organization/rest/api-group-directory/\#api-v1-orgs-orgid-users-invite-post
   
   I'm working with an API client and I need to be able to use these endpoints on my Atlassian organization.
   
   My organization ID is: <ATLASSIAN_ORGANIZATION_ID>
   
   Thanks in advance for your help!
   

8. Submit the request.

That’s it! Next, move on to the connector configuration instructions.

Configure the Atlassian connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne
• Access to the set of Atlassian credentials generated by following the instructions above

# baton-atlassian-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-atlassian-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Atlassian credentials
  BATON_API_TOKEN: <Atlassian organization API access token>
  BATON_ORG: <Atlassian org ID>

  # Optional: include if you want ConductorOne to provision access using this connector
  BATON_PROVISIONING: true

# baton-atlassian.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-atlassian
  labels:
    app: baton-atlassian
spec:
  selector:
    matchLabels:
      app: baton-atlassian
  template:
    metadata:
      labels:
        app: baton-atlassian
        baton: true
        baton-app: atlassian
    spec:
      containers:
      - name: baton-atlassian
        image: ghcr.io/conductorone/baton-atlassian:latest
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: baton-atlassian-secrets