Who can do it: Company admins
Which plans: Enterprise
✏️ Connecting Jira using an authorization server is only enabled at the organization level.
This article provides the steps for connecting Miro to Jira with a third-party, on-premise authorization server using OAuth2.0.
To learn the technical details about this configuration, see the reference article for Jira on-premise with third-party authorization using OAuth 2.0.
Prerequisites
- Ensure that you have the following permissions:
- Miro Company admin
- (Optional) Jira System admin, if you want to use automatic webhooks.
- On your authorization server, create an OAuth 2.0 app.
-
Configure the redirect URL in your OAuth 2.0 app to the following URL:
https://integrations.miro.com/api/external-auth/oauth2/callback -
Ensure you have the following details from your OAuth 2.0 app ready to set up in Miro:
- Authorization URL
- Token URL
- Client ID
- Client secret
- Scope
Connect to Jira on-premise with third-party servers using OAuth 2.0
- On your Miro dashboard, select your avatar in the top-right and go to Admin console | Settings.
- Go to Apps and integrations
> Apps > Manage apps tab.
- Ensure that Allow only apps from the list below is enabled.
- Under the App column, for Jira Cards select Settings.
- Click Add new connection.
- Under Jira setup, click Jira Data Center.
- Under Authentication method, select OAuth2.0 via a third-party authorization server.
-
Under Jira URL, enter your Jira instance URL.
✏️ You can add your external Jira base URL, or your internal Jira URL. If you use an internal Jira URL, then you must specify your external API gateway URL in step 10.
✏️ In general, using an internal URL enables you to adjust the navigate-to-source functionality.
-
(Optional) To make this connection the default connection for all teams in your organization, tick Make Default.
- (Optional) If you use an API gateway to make requests to Jira, then for Jira API Gateway base URL, enter your external API gateway URL.
- Enter the following details from your OAuth 2.0 app:
- Authorization URL
- Token URL
- Client ID
- Client Secret
- Scope
-
(Optional) To get real-time updates from Jira in Miro, tick Create webhook automatically.
✏️ You can manually add the webhook later.
-
Click Connect.
- Follow the authentication flow for your authorization server. If prompted, log in to your environment.
When your connection completes, your Jira instance is listed under Connected instances with the following tag: Auth server.
Ensure your team can authenticate
Now that you have connected your Jira instance at the organization level, you can start using Jira at the team level.
- On your Miro dashboard, select your avatar in the top-right and go to Admin console.
-
Select Teams > Your team.
The Your team slider opens. -
Select the Apps tab.
- From the apps list select Jira cards.
- Under Admin settings, verify whether your Jira configuration shows the GLOBAL CONNECTION label, and shows the correct Jira instance URL, then do one of the following:
- If yes, you have completed this procedure. You can skip to What next?
- If no, select Change configuration > Global Organization Settings > your Jira instance.
- Select Save settings.
What next?
Each team member must authorize their user account. To ensure that each user obtains access and refresh tokens, when a team member attempts a Jira-related action on a Miro board, they will be prompted to authorize their account.
FAQ
You can use any authorization server that supports standard OAuth 2.0 protocols for on-premises environments. For example, Azure Active Directory (Entra ID) and Okta.
Yes, but you must manually add the server to each organization.
No. If you need to change the client secret, then you must disconnect and reconnect your instance.
Yes. Depending on the selected configuration, admins can continue to use the native authorization flow in Jira.
You can update teams to your organization default Jira settings.
No. Mapping between authorized users and Jira users is the responsibility of the customer environment via their API gateway. Miro doesn't control this gateway.
If all of the following items are true, then OAuth 2.0 via a third-party authorization server is a good fit:
- Your Jira instance is hosted on-premises.
- External access to Jira is only possible with an API gateway.
- The API gateway enforces authorization using a custom authorization server.
- You must connect Miro to Jira without exposing the Jira public base URL.
This solution is designed for organizations that host Jira on-premises and route external API traffic through an API gateway. In this setup, Jira isn't publicly accessible, and access is controlled via a custom authorization server. Instead of having a public base URL for Jira, this solution allows you to connect your on-prem Jira instances by configuring Miro to authenticate via your own authorization server.