ConductorOne docs

Set up a Jira Cloud connector

ConductorOne provides identity governance for Jira Cloud. Integrate your Jira Cloud instance with ConductorOne to run user access reviews (UARs) and enable just-in-time access requests.

Yes, there are TWO kinds of Jira integration! The instructions below connect a Jira Cloud instance with ConductorOne so that you can review access data and grant user access to Jira.
If you want to set up an integration with Jira Service Management that allows ConductorOne Copilot to create, modify, and resolve Jira service desk tickets, go to Generate access requests through a service desk.

Capabilities

Resource	Sync	Provision
Accounts	✅
Groups	✅	✅
Projects	✅
Roles	✅

Known limitations

User email is not currently synchronized
Will only list the first 1,000 users of a project

Available hosting methods

Choose the hosting method that best suits your needs:

Method	Availability	Notes
Cloud hosted	✅	A built-in, no-code connector hosted by ConductorOne.
Self-hosted	✅	The Jira connector, hosted and run in your own environment.

Gather Jira Cloud credentials

Each setup method requires you to pass in credentials generated in Jira Cloud. Gather these credentials before you move on.

A user with Administrator access in Jira Cloud must perform this task.

Create an API token

Log into your Jira account with Administrator access.
Navigate to https://id.atlassian.com/manage-profile/security/api-tokens.
Click Create API token.
Give your token a label, such as ConductorOne, and click Create.
Carefully copy and save the newly generated API token.

Additional credentials

To set up the connector, you’ll also need:

Your Jira Cloud URL in https://your-domain.atlassian.net format
The email address for your Jira Cloud account

That’s it! Next, move on to the instructions for your chosen setup method.

Set up a Jira Cloud cloud-hosted connector

To complete this task, you’ll need:
The Connector Administrator or Super Administrator role in ConductorOne
Access to the set of Jira Cloud credentials generated by following the instructions above

In ConductorOne, click Connectors > Add connector.
Search for Jira Cloud and click Add.
Choose how to set up the new Jira Cloud connector:
- Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
- Add the connector to a managed app (select from the list of existing managed apps)
- Create a new managed app
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.
If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.
Click Next.
Find the Settings area of the page and click Edit.
Enter your Jira Cloud domain (the URL of your Jira Cloud instance is <YOUR DOMAIN>.atlassian.net) into the Jira site domain field.
Enter the email address for your Jira Cloud account in the Your Jira email address field.
Paste the API token you generated in Step 1 into the API token field.
Optional. If you want to automatically create Jira Cloud tickets to track provisioning tasks, click to Enable external tick processing. Read more about external ticketing system integrations here.
Click Save.
The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Jira Cloud connector is now pulling access data into ConductorOne.

Set up a Jira Cloud cloud-hosted connector using Terraform

As an alternative to the cloud-hosted setup process described above, you can use Terraform to configure the integration between Jira Cloud and ConductorOne.

See the ConductorOne Jira Cloud integration resource page in the ConductorOne Terraform registry for example usage and the full list of required and optional parameters.

Set up a Jira Cloud self-hosted connector

To complete this task, you’ll need:
The Connector Administrator or Super Administrator role in ConductorOne
Access to the set of Jira Cloud credentials generated by following the instructions above

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.

Why use Kubernetes? Kubernetes provides automated deployment, scaling, and management of your connectors. It ensures high availability and reliable operation of your connector services.

Step 1: Configure the Jira Cloud connector

In ConductorOne, navigate to Connectors > Add connector.
Search for Baton and click Add.
Choose how to set up the new Jira Cloud connector:
- Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
- Add the connector to a managed app (select from the list of existing managed apps)
- Create a new managed app
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.
If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.
Click Next.
In the Settings area of the page, click Edit.
Click Rotate to generate a new Client ID and Secret.
Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Jira Cloud connector deployment:

Secrets configuration

# baton-jira-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-jira-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Jira Cloud credentials
  BATON_JIRA_URL: <Jira Cloud tenant URL in https://domain.atlassian.net format>
  BATON_JIRA_API_TOKEN: <Jira Cloud API token>
  BATON_JIRA_EMAIL: <Email address associated with your Jira Cloud account>

  # Optional: include if you want ConductorOne to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-jira.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-jira
  labels:
    app: baton-jira
spec:
  selector:
    matchLabels:
      app: baton-jira
  template:
    metadata:
      labels:
        app: baton-jira
        baton: true
        baton-app: jira
    spec:
      containers:
      - name: baton-jira
        image: ghcr.io/conductorone/baton-jira:latest
        args: ["service"]
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: baton-jira-secrets

Step 3: Deploy the connector

Create a namespace in which to run ConductorOne connectors (if desired):
```
kubectl create namespace baton-jira
```

Apply the secret configuration:

kubectl -n baton-jira apply -f baton-jira-secrets.yaml

Apply the deployment:

kubectl -n baton-jira apply -f baton-jira.yaml

Step 4: Verify the deployment

Check that the deployment is running:
```
kubectl -n c1 get pods
```

View the connector logs:

kubectl -n c1 logs -l app=baton-${baton-jira}

Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Jira Cloud connector to. Jira Cloud data should be found on the Entitlements and Accounts tabs.

That’s it! Your Jira Cloud connector is now pulling access data into ConductorOne.