--- title: "How to Configure EasySSO v2.6.0 - v3.4.2" canonical: "https://www.techtime-initiative.com/space/EasySSO/6521550/How%20to%20Configure%20EasySSO%20v2.6.0%20-%20v3.4.2" format: markdown --- How to configure EasySSO for versions 2.6.x - 3.4.x – a step-by-step guide > ℹ️ **Please Note:** This page applies to EasySSO versions from 2.6.0 to 3.4.2. > ℹ️ > ℹ️ If you are using earlier versions – please read instructions on [How to install EasySSO for 2.5.x and earlier](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/6423388) page instead. > ℹ️ > ℹ️ If you are using later versions – please read instructions on the [Getting Started with EasySSO](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/6423587) all-in-one home page. > ℹ️ > ℹ️ If you have any questions please reach out to our support via our [ServiceDesk](https://katara.techtime.org/jira/servicedesk/customer/portal/9) ## Step 1: Install and License EasySSO Obtain EasySSO from the Atlassian Marketplace. Install a licence for EasySSO. If you already have a production one in your My Atlassian portal - find it, and copy/paste into EasySSO's record in Universal Plugin Manager (UPM) under Manage apps. #### If you need a Free Trial licence: If you have Internet connectivity from the Atlassian application: Usually during the installation of a new app in the UPM you will be asked for credentials to your My Atlassian portal in a popup. Enter these, and after filling the name of the organisation for the licence, you will have access to the licence and the option to have it installed automatically. Alternatively, Obtain an EasySSO licence from the Atlassian Marketplace by clicking `Try it free` and copy/paste the licence into EasySSO's record in the UPM under Manage apps. ## Step 2: Navigate to the EasySSO NTLM/Kerberos configuration screen Once installed click `Configure` in UPM to proceed to the configuration wizard. You can also arrive to this screen by clicking `EasySSO` link under "TechTime Add-Ons" section usually located in the left panel of the Admin screen. Click on `NTLM/Kerberos`. ## Step 3: Install IOPLEX Jespa Follow the link on the screen to the to [Downloads ](https://www.ioplex.com/downloads.php)section of IOPLEX Jespa website. Obtain the IOPLEX Jespa library (the .zip distribution, not the .tar.gz one). Save, and **do not unzip**. Upload it into EasySSO config screen (you should already be on the "IOPLEX Jespa Licensing" tab). An "About" dialogue will pop up. "Trial period" refers to IOPLEX Jespa Free trial period when it operates in unlimited number of users mode. After this period it will automatically revert to 25 unique users only mode. If you require more time to evaluate, once you renewed EasySSO evaluation license via Marketplace, repeat this very step, downloading a fresh IOPLEX Jespa distribution. Read the IOPLEX EULA. We also have a page on[ the role of IOPLEX Jespa library in EasySSO](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/3211364) if you are curious. ![image-20240902-013054.png](media://809d7013-5597-4245-9bfe-dbab292f7ba0) > ⚠️ **IMPORTANT** > ⚠️ > ⚠️ Continuing past this point signifies your acceptance of the terms of IOPLEX EULA. ## Step 4: Fill in your domain Go to the "EasySSO Configuration" tab, and fill in your domain name. If you don't know what your domain is, it is best to consult your Active Directory admin. Alternatively you can use the method described in our "[Determining AD forest](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1704024)" FAQ page. One of the values returned will be the domain name ("Dom Name"). ![image-20240902-013112.png](media://ed09620b-1aea-4329-ac93-4fe7d45005af) ## Step 5: Obtain a **computer*** *Active Directory account** with a password **in your Domain from your Active Directory administrator > ℹ️ **This is the most important part of the configuration.** If this takes more time than expected, you can save the values already entered on this screen (if any) and return to this screen later. > ⚠️ **IMPORTANT** > ⚠️ > ⚠️ You will need a new/dedicated computer account with a password. It's not a user account or what is known a "service" account. **Please do not re-use computer accounts created for other instances of EasySSO** (e.g. test environment or other Atlassian applications). For details see: [I have multiple instances of EasySSO - how many computer accounts do I need?](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1736801) in our [FAQ](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1638405) Since creating this requires one to be logged in as an Active Directory administrator - we cannot automate this task, please work with your Active Directory administrators on this. The account can be created (also known as "pre-staged") using standard Microsoft tools as described in [this Technet article](https://technet.microsoft.com/en-us/library/cc754478%28v=ws.11%29.aspx). Password for the computer account can be set from the command line using the following command described in [this Technet article](https://technet.microsoft.com/en-us/library/bb490718.aspx). ``` net user /domain command ``` Alternatively you can do it with the following PowerShell cmdlet as described in [this article](https://learn.microsoft.com/en-us/powershell/module/activedirectory/set-adaccountpassword?view=windowsserver2022-ps). ``` Set-ADAccountPassword -Identity -Reset -NewPassword ``` These commands can be run on any domain-connected workstation, but do require the user who runs them to be an Active Directory administrator. If you or your AD admin requires more details, please read ** ****[IOPLEX Jespa Operators Manual](https://www.ioplex.com/pdf/Jespa_Operators_Manual.pdf)**** ** about these (pages 7-8). The manual is also available for download from the link on the EasySSO Configuration tab and the About screen once you've uploaded IOPLEX Jespa .zip package.  Please pass IOPLEX Jespa .zip package to your administrators – it contains the Operators Manual as well as the necessary command-line scripts to help them accomplish this task (if for some reason they do not like the standard ones mentioned above). IOPLEX Jespa package contains two .vbs scripts – one script is a full wizard that will create the computer account and set the password - you will need to be an Active Directory administrator to be able to run these scripts. The other one can be used by your domain administrators to set a password on computer account if they create it manually using default tools from Microsoft. #### If you are an Active Directory administrator The download link “SetComputerPassword.vbs script” is available on the EasySSO Configuration tab in the help hint of the password field. You will have to rename the file to *.vbs as browsers won't download it as is. The script is plain text - feel free to open it up in a any text editor and review.
More information on computer accounts [Why do I need a new computer account? ](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/3211468)   [Can I use a user account?](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1703959) [Can I use a service account?](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1736712) [Can I use the account of the same server/VM/box that Jira/Confluence/Bitbucket/Bamboo/Fisheye is installed on?](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1638438)
## Step 6: Fill in computer account credentials On the EasySSO Configuration page, fill in computer account credentials. Press Test Connection. EasySSO will attempt to discover your Domain Controllers automatically from DNS and connect to one of them via the NETLOGON protocol. If you receive an error message, please examine logs, specifically *jespa.log* - [here is how to get the logs](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/4522300). Most of the common errors are described in Troubleshooting section ** ****[IOPLEX Jespa Operators Manual](https://www.ioplex.com/pdf/Jespa_Operators_Manual.pdf)**** **(pages 27-32). The manual is also available for download from the link on the EasySSO Configuration tab and the About screen once you've uploaded IOPLEX Jespa .zip package. Chat to our 24x7 support (bottom right of this very page) and we will assist you. ## Step 7: Testing Once the connection works, SSO should work too. Test in Incognito/In-Private mode or with another browser. If you are kicked out to login page or logout after successful SSO, make sure you close the browser window (to clear out the cookies) and then navigate to the Atlassian application again in a new browser window. If you receive any error messages or observe some unexpected behaviour (e.g. domain credentials popup), please review items below, and examine logs, specifically *jespa.log* -  [here is how to get the logs](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/4522300). Chat to our 24x7 support (bottom right of this very page) and we will assist you. ## Extra configuration for reverse proxies If you are running behind a reverse proxy, you will need additional configuration. We have how-to guides in our [FAQ](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1638405) for the following: - [Apache](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/3211706) - [NGINX](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1736754) - [IIS](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/3244389) ## Extra configuration for Atlassian Application Links If you are installing EasySSO into multiple Atlassian applications that are integrated via Application Links you will need to configure mutual filtering between applications as NTLM/Kerberos is not supported when building or verifying the application link. This can be done either using [IP Filtering](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/4096096) or [User-Agent filtering](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/4587987) to disable NTLM/Kerberos for application-to-application requests. For example when Jira contacts Confluence and vice versa. User-Agent filtering seems to be preferred by most customers. In our [FAQ](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1638405) we specifically answer the question "[My Application Links don't work after installing EasySSO?](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/3244453)" with instructions on how to configure User-Agent filtering. ## Extra configuration for Bitbucket There may be some extra configuration needed for authenticating git clients in Bitbucket. See [How can I use SSO to authenticate git clients in Bitbucket?](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/3146015) ## Browser settings For the duration of your testing, especially if this is done in a freshly built test environment, you may need to change the browser settings according to [these instructions](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/3276970). Once you are deploying to production - usually the corresponding settings are applied via domain global policies automatically. ## Advanced configuration for EasySSO If you want to configure EasySSO further please read the [Advanced configuration for EasySSO](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/4096160) instructions. Here you will find information on: - Specifying log levels and log file locations - The AD site configuration - please read our FAQ article: [Determining existing AD sites](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1474675) - Choosing the canonical form of your user accounts - make sure it matches the form of the usernames used in Atlassian application - [Configuring Kerberos](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1474702) (please make sure that NTLM SSO works first!) Also take a look at our [FAQ](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/1638405) to see if there are any scenarios that apply to you which could make your life easier. > ℹ️ Also please read: > ℹ️ > ℹ️ [Please read about some licensing hurdles between Jespa and EasySSO](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/4587705) > ℹ️ > ℹ️ [Do I need two licenses for Jira and Jira Service Desk?](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/3276824) > ℹ️ > ℹ️ [What user level do I need for EasySSO on Jira Service Desk?](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/2916398)