Two-step verification login for Data Center

Announcements
, , ,
22

I see, thanks for the info! We will be providing a JVM flag that will allow restoring legacy authentication behavior to facilitate testing or for resolving problems. Depending on what accounts are used in your tests and what ways of interaction are used by tests (logging in via the login form/login endpoints, basic authentication to REST endpoints, personal access tokens used on REST endpoints) it may also be that your users would not have to undergo additional verification.

23

Based on your feedback we decided to disable the enforcement for system admin by default. This means, by default, 2SV will be optional for admin and regular users. Still, there will be a possibility to enable the enforcement by the customer (most likely by enabling system property for enforcing 2SV on system admin). Once the customer decides to enable it, the enforcement will work in similar way as it is in the prototype.

24

Hey, I just gave the pre-version a try.

I have two things:

  1. Could you please add an id to the login form HTML element? We have a function to inject SSO buttons into the login form. While I can search for the element by class, the class name is randomly generated and might change after an update. I would like to avoid this. Thus, by providing a stable id makes my life much easier.

  2. When installing the pre-release app, the Jira dashboard login gadget is gone. And when uninstalling the app, it is still gone. Is this intentional? (And how can I get it back without creating a new test instance).

Best regards,
Christopher

25

Hello Chris,

  1. Yes, we can do it, no problem.
  2. In the production version the Jira dashboard login gadget will be no longer available, as we are completely replacing the old login page with the new one.
26

Thanks for adding the ID! If you have another pre-built, I would love to try that out before it goes into production.

Regarding the login gadget on the dashboard … personally, I would love for this to stay, when you don’t activate the 2fa functionality. I feel like there will be customers not being happy about that when not using 2fa.

Best regards,
Christopher

27

Hi @chrschommer

Thank you for the feedback!

With the implementation of the new solution, the login dashboard gadget is planned for deactivation and will not be visible on the user interface. The login process will be managed through the new login flow, incorporating a two-step verification (2SV) capability.

In the event of an urgent requirement to reinstate the gadget, a property will be available to revert to the previous functionality (referenced here). However, it is anticipated that this property will only be utilized as a last resort, considering that the new flow with 2SV capability will be deactivated if the property is used.