SAML SSO authentication failure with JIT in Bitbucket Data Center: 'Received SSO request for user, but the user is not permitted to log in'
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
SAML SSO integration with JIT (Just In Time) option enabled in Bitbucket Data Center throws error "We can't log you in right now."
In the logs, we see the error:
1
2023-03-29 12:49:12,472 ERROR https-jsse-nio-7990-exec-5 @HGA6LMx769x180350x0 8080k 10.20.30.40,10.16.61.10 "POST /plugins/servlet/samlconsumer HTTP/1.1" c.a.p.a.s.w.f.ErrorHandlingFilter 47e2e66e-2a42-abcd-efgh-ab94dd3c4aq Received SSO request for user xyz, but the user is not permitted to log inEnvironment
Bitbucket Data Center 7.17.16
SAML SSO Integration with IDP (Google IDP, Azure AD etc.)
Diagnosis
For "User is not permitted to log in", please verify following points:
1. Get the user id from the Name ID format of the SAML response and verify if Bitbucket contains the user with a username matching the Name ID field.
2. If the user is present in Bitbucket, Does the Group to which user should belong to has been created in Bitbucket (which should be similar to the Group assigned in IDP for Groups or groups attribute)?
3. If the user is part of a Group in Bitbucket as mentioned in step 2, Does Group holds valid permissions?
Cause
This issue occurs when the JIT option is enabled in SAML SSO configuration and the Group which should be created in Bitbucket before the User login to Bitbucket, doesn't have added in the "Global Permission" → "Groups" section in Bitbucket.
Solution
You need to make sure that the Group has been added to the Bitbucket → Global Permissions → Group access section and that it has the required permissions.
Was this helpful?