Skip to main content
This article covers Jira Server Provisioning, account and group-membership management for self-hosted Jira Server/Data Center. For the ITSM integration that syncs users and logs and syncs access-request tickets, see Jira. For Jira Cloud provisioning, see Jira Provisioning.

​
After this article

You will be able to connect a self-hosted Jira Server/Data Center instance to Lumos to sync and provision Jira user accounts and their access-control group memberships, and to track users’ last login.

​
Capabilities

Activity tracking is supported. Lumos tracks users’ last login.

​
Required plan and roles

  • The service account that creates the personal access token should be in the jira-administrators group with the Jira Administrators global permission.
  • Authentication is a personal access token (PAT) plus your instance base URL. Group browsing must not be restricted, and custom permission schemes must allow viewing project roles.
  • Your Jira Server instance must be reachable from the internet. If it sits behind a firewall, allowlist the Lumos IP addresses 44.228.74.159 and 54.244.99.235.
  • This integration can only be connected with provisioning access. There is no read-only variant.

​
Read-only access vs provisioning

Is read-only possible? No. This integration only connects with provisioning access. There is no read-only variant. If you only need to sync Jira users and log or sync access-request tickets without managing accounts or group memberships, use the separate Jira ITSM integration instead. That integration connects to self-hosted Jira Server with a Site Admin personal access token. What full provisioning requires. A personal access token (PAT) from a service account in the jira-administrators group with the Jira Administrators global permission, plus your instance base URL. Follow the steps below. Watch out for. Group browsing must not be restricted and custom permission schemes must allow viewing project roles, or the connection reports “Insufficient permissions” even with a valid token. Because this integration has no read-only mode, connecting it for visibility alone still means granting a PAT that can create, deactivate, and delete Jira accounts.

​
Instructions

Phase 1: Prepare Jira Server
  1. In Jira, click your avatar (top right) → Profile → Personal access tokens (left menu).
  2. Click Create token, give it a name, and set the expiration date (or disable expiration completely).
  3. Click Create and copy the token.
  4. Copy your instance base URL from the browser while logged in (for example https://jira.your-organization.com). Include the scheme (https:// or http://). Port numbers and a base path are also supported.
Phase 2: Connect in Lumos
  1. Open the Jira Server Provisioning integration card in Lumos.
  2. Enter the Personal Access Token and the Account Base URL from Phase 1.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

“Unable to reach Jira Server”. Verify the instance is accessible from the internet, the URL includes the protocol (https:// or http://), the Lumos IPs (44.228.74.159, 54.244.99.235) are allowlisted in your firewall, SSL certificates are valid, and the server is running. You can test connectivity with curl from an external server. SSL certificate verification failed. Ensure the certificate is valid, unexpired, matches the domain name, and the chain is complete. For self-signed certificates, contact Lumos support. “Insufficient permissions”. Ensure the service account is in the jira-administrators group with the Jira Administrators global permission, group browsing isn’t restricted, and custom permission schemes allow viewing project roles. Intermittent failures. Check firewall logs for blocked requests, verify rate limiting isn’t blocking requests, confirm reverse proxy and load balancer settings route requests correctly, and monitor server performance and network logs for dropped connections.