
### Double-Up your Atlassian Security with MFA! {#double-up-your-atlassian-security-with-mfa}

miniOrange stands as a reputed partner and provider of security and SSO solutions for multiple platforms being WordPress, Joomla, Shopify, Drupal & many more, within the industry. Built on a strong foundation of security fundamentals, we provide secure and reliable Identity and Access Management (IAM) solutions that integrate seamlessly with the customer’s existing frameworks. We provide SSO solutions for all the Atlassian applications using protocols like SAML, OAuth 2.0, OIDC, etc. SSO enables users to securely authenticate with multiple applications by logging in only once – with just one set of login credentials. miniOrange has grown from its initial size of 4 to 150+ now. The company was built from the ground up by a group of experienced technology architects, with a background in security themselves.


Unwilling to continue in their day jobs, the team began miniOrange. Having a deep understanding of security, the miniOrange team applies their technical expertise to create unique and helpful solutions to the needs and challenges of the industry. The company aims to give organizations the ability to securely manage access to all of their web based applications in one place. We are growing day by day and will continue to do so!

&nbsp;&nbsp;

The miniOrange’s expertise in Identity And Access Management (IAM), Single Sign-On, Multi-factor Authentication, Network Security, API Security, Cyber Forensics. The central focus of our products and company revolve around these themes. Our solutions are specific, accurate and, most importantly, great at doing what they’re supposed to: Making you more secure!


### What is MFA/2FA ? {#what-is-mfa/2fa}

Multi-Factor Authentication (MFA) is an authentication method that requires the user to authenticate themselves for two or more factors, in order to gain access to company resources, applications, or a VPN. Enabling Multi-Factor Authentication (MFA) means that users need to provide additional verification factors apart from their username and passwords. These second-factor methods can range from OTP over SMS, OTP over Email, Push notification, Google/Microsoft authenticator, and many more. 

&nbsp;&nbsp;

Having this extra layer of security ensures that the information being accessed is well protected from activities such as phishing, malware, hacking, and many more. Having a strong MFA setup ensures a robust Identity and Access Management (IAM) for your organization and secures your resources.

![2fa](/blog/assets/2023/configure-two-factor-authentication.webp)


The goal of leveraging MFA is to boost security and make a layered defense so that even if one factor (username-password) is stolen, the cyber attacker still has at least one more barrier to breach before successfully breaking into the actual targeted device. The second barrier is also usually harder to breach as compared to simple username passwords.

### How does it work? {#how-does-it-work}

One of the first steps of access control is the identification and authentication of users. There are three common factors used for authentication:

- Something you know (such as a password)
- Something you have (such as a smart card)
- Something you are (such as a fingerprint or other biometric method)

Identification occurs when a user professes an identity (such as with a username), and authentication occurs when users prove their identity. For example, users are authenticated when they provide both their username and correct password. Permissions, rights, and privileges are then granted to users based on their proven identity.

![MFA](/blog/assets/2023/mfa.webp)

### Our Products {#our-products}

![products](/blog/assets/2023/our-mfa-products.webp)

&nbsp;&nbsp;


We offer MFA for Server, Data Center & Cloud. 

- For Server & Data Center, it’s available for **Jira, Confluence, Bitbucket, Bamboo & Crowd.**
- For Cloud, we have a solution available for **Jira, Confluence and Bitbucket.**

### Features Our MFA Addons Provide {#features-our-mfa-addons-provide}

#### Supported MFA Methods

We have highest number of supported methods for MFA:
Mobile Authenticator (TOTP)

1. OTP over Email
2. OTP Over SMS
3. Hardware Token (Yubikey)
4. WebAuthn
5. Duo Push Notification
6. Backup Methods
7. Security Questions
8. Backup Codes

Admin options for User management

1. Enable 2FA for Jira Software and/or Jira Service Desk
2. Choose 2FA methods for end users
3. Enable, Disable & Reset 2FA for users 
4. Enable 2FA based on groups
5. Skip 2FA for a specific group

### Security {#security}

#### 2FA for Jira Service Desk 

2FA for Service Desk is the most used feature of our addon. In organizations, there are two types of users – one is employees and the other is customers. 

The employees use multiple applications (Jira, Confluence, Bitbucket, Jenkins, Sonarqube, etc) and usually there is one central application used to manage all the users at one place, which is known as an IDP(Identity provider). So organizations connect all the applications to the IDP and users login using Single Sign on. And along with Single sign on, they also enable second factor authentication on the IDP itself. 

In Jira Service Desk, as the customers are unlicensed users, they are usually managed on the Jira itself. We allow 2FA for those customers as well. 


#### Brute Force Protection

Brute Force Attacks are hacking methods that use trial and error methods to guess user credentials and gain unauthorized access. 

In the case of 2FA,  there are Brute Force 2FA Attacks. Here hackers first get the credentials and then try all the combinations of the OTP code (which is generally 6 digit) to gain unauthorized access.

Using the Brute force protection feature, you can restrict the number of continuous invalid 2FA attempts, making it impossible for the hacker to guess the OTP.

### Usability {#usability}

#### IP Whitelisting 

Here you can whitelist a range of IPs and the plugin will skip 2FA if the user is trying to login there which improves the usability of users. 

During the pandemic many organizations introduced 2FA. As employees started working from home, they were no longer logging in from the secure company’s Network. So it becomes easier for intruders to get into systems. And to solve this issue, they introduced 2FA. 

Here the IP whitelisting feature helps improve the usability of the employees. The admin can whitelist all the IPs inside the company network. So now if an employee tries to login from within the company’s network then 2FA will be skipped for that user. And if the same user tries to login to Jira from home (via some other laptop or from mobile phone) then the 2FA will be enforced.

#### Remember My Device

This feature helps a user mark some devices as trusted devices. 

So from next time 2FA will be skipped on that device for that user. So users don’t have to enter the 2nd factor again and again.

### 2FA For Atlassian Cloud {#2fa-for-atlassian-cloud}

To enable MFA on Atlassian cloud, you need Atlassian Access. It is a separate module created by Atlassian to provide functionalities like Single Sign on, 2FA and user management for all the cloud applications.

It supports two 2FA methods.

- Mobile Authenticator
- Backup Codes.

If these 2FA methods are sufficient to your organization then you can directly use Atlassian Access. 

**There are two limitations in Atlassian Access:**

1. It supports only 2 basic 2FA methods.
2. It does not allow using SSO and 2FA at the same time for a user.
miniOrange cloud 2FA solution overcomes these limitations. There are a total 3 important use cases where miniOrange cloud 2FA solution will be used:

**Case 1:**

Suppose you are already using 2FA methods like OTP over Email in your organization and you want to enable the same for Atlassian Cloud apps. Then Atlassian Access won’t be sufficient. Here you can use the miniOrange solution where almost all the 2FA methods are supported.

![2fa-methods](/blog/assets/2023/methods-of-2fa.webp)

**Case 2:**

Second case is, your users are stored on an Identity Provider(IDPs), your users login using SSO into Atlassian Applications and you want to enforce 2FA for your users. As Atlassian Access does not allow SSO and 2FA at the same time, it adds a compulsion on Identity Providers to have inbuilt support for Two Factor Authentication. But even many popular Identity Providers like ADFS, Keycloak, Auth0 and Shibboleth don’t support 2FA. Here miniOrange Identity Broker Solution can be used.

![atlassian-cloud](/blog/assets/2023/atlassian-cloud.webp)

**Case 3:**

Third case is, your users are stored on an IDP and your IDP supports 2FA as well. But it does not support the 2FA method that you want, (which you are already using in your organization).

**Contact:  atlassiansupport@xecurify.com**
**Visit: [www.miniorange.com/atlassian](https://www.miniorange.com/atlassian)**

Multi-Factor Authentication (MFA) is an authentication method that requires the user to authenticate themselves for two or more factors, in order to gain access to company resources, applications, or a VPN.

Double-Up your Atlassian Security with MFA!


## Atlassian’s Server License Discontinuation: What are your options? {#atlassian's-server-license-discontinuation}

By now, everyone is aware of Atlassian’s announcement on Server license discontinuation and selling new server license instances from Feb 2, 2021. If you have been living under a rock and missed the announcement, you can check it out here: 

[https://www.atlassian.com/blog/announcements/journey-to-cloud](https://www.atlassian.com/blog/announcements/journey-to-cloud)

&nbsp;&nbsp;


![atlassian-server](/blog/assets/2023/atlassian-server-license-discontinuationtimeline.webp)

&nbsp;&nbsp;

### To whom end of life applies to? {#to-whom-end-of-life-applies-to}
- Jira Software Server
- Jira Core Server
- Jira Service Management Server 
- Confluence Server
- Bitbucket Server
- Crowd Server
- Bamboo Server
- Atlassian-built Server apps

&nbsp;&nbsp;

**10 – 50 Users:**

With this tier, you will find it easier to just go ahead with Cloud Migration, as upgrading to DC will prove to be a big financial overhead. The basic data security has been taken care of by Atlassian and unless you have stringent security compliance needs, moving to Atlassian Cloud will be a perfect solution for you. There is a free license available as well, although with very limited features. For a smooth transition to cloud migration, we at miniOrange will provide seamless support. You can find out more about Single Sign On for Cloud over at [https://www.miniorange.com/atlassian-cloud-single-sign-on-(sso)]

&nbsp;&nbsp;

If you do have security compliance needs, you can check Atlassian cloud’s security and compliance details here: [https://www.atlassian.com/trust](https://www.atlassian.com/trust). If the compliance you’re looking for is not listed, you should stick to Server for now and raise a request with Atlassian support to know whether it’s in their pipeline and make a decision accordingly.

&nbsp;&nbsp;

**Our Recommendation: Atlassian Cloud**

### 100 Users {#100-users}
If your users fall into this category and you foresee a rise in their numbers and have strict compliance criteria, there is no better alternative than Atlassian Data Center. However, if you do not need compliances, you might want to consider cloud migration as it would be a cheaper option.

**Our Recommendation: Atlassian Data Center**

### 250 Users and more {#200-users-and-more}
The Data Center will be the best choice for the tier with more users. As the number of users in the cloud increases, it will become expensive. You could also be using a lot of marketplace applications, which are more likely to be available on Atlassian Data Center rather than cloud, so keep that in mind.

&nbsp;&nbsp;

**Our Recommendation: Atlassian Data Center**


Our suggestion is based on what we believe is best for you, but you are free to think outside the box. Here are a few points to think about when deciding between Cloud and Data Center:

1. What is the user-tier for you? Will it be the same after 1-2 years?
2. Do you want security certifications?
3. What do you have in your budget?
4. Compatibility of Marketplace Apps
5. Storage Requirements
6. Load on applications (using multiple machines to balance the load)

&nbsp;&nbsp;

I hope that this article has helped you recognize the different factors to be considered while migrating and has assisted you in making rational choices.

As a customer-centric Atlassian SSO vendor, we are committed in helping our server customers to who wish to take up Data Center Migration. We will be providing full support and maintenance for all our Server add-ons till 2024.

&nbsp;&nbsp; 

It’s hard to leave until you have to leave. Wishing you a smooth and easy migration.


&nbsp;&nbsp;

 
Contact Us – Drop us a mail at info@xecurify.com or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





By now, everyone is aware of Atlassian’s announcement on Server license discontinuation and selling new server license instances from Feb 2, 2021. If you have been living under a rock and missed the announcement.

Atlassian’s Server License Discontinuation: What are your options?


## How to secure Atlassian Cloud Applications ?

**“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.”**
**– Edward Snowden**

Atlassian’s announcement that it would be shutting down its server instances had a significant impact on the customers. Confusion grew among people as some chose Atlassian’s Data Center while others chose Atlassian Cloud. Both Data Center and Cloud have their own set of benefits and drawbacks. Given that Atlassian itself faced a cyber attack, one of the most common questions was, “Is Atlassian Cloud secure in terms of cyber threats?”..

Products made by Atlassian are high quality, very secure, and reliable. But as they say, there is always scope for improvement. This article will mainly focus on how we can make Atlassian Cloud applications more secure, avoid cyber-attacks, and ensure vulnerability management.

When we talk about securing an application for thousands of users, adding an extra layer of authentication on top of the basic authentication can prove to be extremely helpful in ensuring security. With 2 layers of authentication, hacking into any system becomes more difficult. Hence, there is an increase in demand for authentication methods such as Single Sign-On (SSO), Two Factor Authentication (2FA), and Multi-factor Authentication (MFA) in the last couple of years.

Atlassian provides an additional level of security by allowing users to Single Sign-On. Single Sign-On (SSO) and Two Factor Authentication (2FA) go hand in hand so it won’t be an issue for customers who are using the in-built SSO solution for Atlassian Cloud.

Let’s understand what Single Sign-On (SSO), Two-Factor Authentication (2FA) or Multi-Factor Authentication (MFA) are and how they are used to secure Atlassian cloud applications.

### Single Sign-On (SSO) {#single-sign-on}

Single Sign-On (SSO) is an authentication process in which a user is authenticated against the Identity Provider which is connected to the Atlassian Applications. These users authenticate using XML assertion in SSO. This reduces security threats and protects user data.

Atlassian has an inbuilt connector for Single Sign On (SSO) which works well for SAML Identity Providers and it is highly recommended to solve complex use-cases like login with multiple IDPs and managing user permissions.

With the miniOrange Atlassian SAML/OAuth Single Sign-On (SSO) plug-in, you can perform seamless login into your Atlassian applications.

### Two Factor Authentication (2FA) {#two-factor-authentication}

Two-factor authentication (2FA), sometimes referred to as two-step verification, is a security process in which users provide two different authentication factors to verify themselves on top of the username and password authentication. This process is done to better protect both the user’s credentials and the resources the user wants to access, which in our case is the respective Atlassian Cloud.

### Multi-Factor Authentication (MFA) {#multi-factor-authentication}

Multi-Factor Authentication (MFA) is an authentication process in which a user has to provide multiple factors of authentications in order to gain access to Atlassian cloud. Rather than just asking for a username and password, Multi-Factor authentication adds additional verification factors such as OTP, push notifications and biometrics that help in adding an extra layer of security to your Atlassian application.

The above explanation was fairly technical so let’s understand this with the help of an example.

Let’s consider an example where you want to make an online transaction. You use credentials to protect your account from unauthorized access. While making a payment, you have to verify the credentials. This acts as the first line of defence. But there is still room for a hacker to gain access to your banking details compromising your security. So, another layer of authentication is added in the form of an ATM pin or OTP over SMS or email. This serves as the second security measure. Only after both steps does your payment go through.

Similarly, here your Atlassian applications like JIRA, confluence and Bitbucket contain confidential information associated with your account and your organization. This content can be protected using our plugins. Not only will our plugin add an extra layer of security, but it will also ensure that the usability and login experience of the users is not compromised upon.

Since the cloud community is still growing, applications that support 2FA over Atlassian cloud are very few. miniOrange can help in fulfilling the needs of Single Sign-On (SSO) as well as Two-Factor Authentication (2FA). The Two-Factor Authentication solution provided by miniOrange over Atlassian cloud contains many authentication methods such as OTP over SMS, OTP Over Email, Hardware Token, Authenticator token, and many more. Our Plug-ins have the capacity to manage a huge number of users. With miniOrange, external and internal users can be managed in one place. It can easily be integrated with external AD/LDAP directories or other Identity Providers (IDPs) without any hassle. Your Atlassian users can use the same credentials and Two-Factor Authentication to access multiple applications.

We have a Two Factor Authentication (2FA) solution for Atlassian Server and Data Center as well. Give a quick read to this [Article](https://community.atlassian.com/t5/Marketplace-Apps-Integrations/Best-way-to-Secure-Your-Atlassian-Data-Center-DC/ba-p/1687486#M4645).

For detailed information about our SSO and Two-Factor Authentication add-ons please refer to the [link](https://www.miniorange.com/atlassian). In case of any queries, please feel free to drop us a mail at [info@xecurify.com](mailto:info@xecurify.com)


Secure Atlassian cloud Apps like Jira & Confluence cloud using miniOrange SSO solution with additional security of Two-Factor Authentication(2FA /MFA)

Secure Atlassian Cloud with Single Sign-On (SSO) & 2FA/MFA


## Log into Atlassian Cloud using External OAuth/OIDC Provider

Atlassian Cloud has become very popular in the last couple of years. It offers competitive pricing, especially for small user-tier applications. Since the announcement of Server discontinuation by Atlassian, more and more customers are moving to Cloud and Data Center. You can check out our article to see if Atlassian Cloud is a good option for you here – [Atlassian’s Server License Discontinuation: What are your options?](https://community.atlassian.com/t5/Atlassian-Cloud-Migration/Atlassian-s-Server-License-Discontinuation-What-are-your-options/ba-p/1635739#)

### What is Atlassian Access? {#what-is-atlassian-access}

Atlassian Access is an enterprise-grade subscription for enhanced security that provides centralized administration and governance. Atlassian Access SSO has security controls like [SAML Single Sign On (SSO)](https://www.atlassian.com/software/access/guide/elements/single-sign-on#how-it-works), User Lifecycle Management, Active Directory Sync, and many more. All these features span across all Cloud apps inclusive of Jira Software, Jira Service Management, Confluence, Bitbucket, Trello, and Statuspage spanning over organizations giving you the ability to use Jira SSO and Confluence SSO.

![Atlassian Access](/blog/assets/2023/atlassian-access.webp)

Single Sign-On into Atlassian Access allows users to authenticate to Atlassian Cloud products through your existing SAML 2.0 Identity Provider giving you the ability to enable and use Atlassian Cloud Jira SSO and Atlassian Cloud Confluence SSO. Cloud SAML Single Sign On (SSO) provides employees with a simple and easy process for accessing the tools that they use and allows admins to enforce identity-related security controls at scale, making the task of securing large groups of users far simpler.

What if users are present in OAuth or OpenID Provider? Will SSO still work? How can we connect Atlassian Cloud (SAML SSO modules) to OAuth/OIDC Providers? Is it even possible?

**YES! It’s possible with miniOrange’s Identity Brokering Service.**

### What is miniOrange Identity Brokering Service ? {#what-is-miniorange-identity-brokering-service}

Identity brokering is a way to establish trust between any two applications that do not speak the same language. Identity Brokering is a service that connects multiple service providers with different Identity Providers. Atlassian Access only allows SAML requests & responses. If your organization uses OAuth/OIDC protocol and would like to use Atlassian Access for Single Sign-On, you’re in somewhat of a fix! This is where miniOrange Identity Brokering comes into play.

![miniOrange Identity Broker Service](/blog/assets/2023/identity-broker-service.webp)

It establishes trust between any two applications like Atlassian Access SSO (SAML) and any OAuth/OIDC Provider that does not speak the same protocol and helps them understand requests and responses. This will be equivalent to a language translator where translators understand one language and translate it into another language. While using a translator, one needs to know at least one of the languages, whereas while using our product – you do not need to worry about any of the protocols. Users will still see the same flow which they see with other apps. **On accessing Atlassian, they will see the OAuth Provider’s login page, they will not see any miniOrange page or login screen in between, so users will not notice the integration with miniOrange**.

You can use both Cloud Jira SSO and Cloud Confluence SSO through one centralized miniOrange offering. Applications that do not communicate with each other using the same protocol are known as cross-protocol applications.

Over the years we have developed many standards for doing this like SAML, OpenID, OAuth, OpenID Connect, but the problem is that very few people can get these protocols talking to each other safely and quickly. miniOrange’s Identity Brokering, built-in to our proprietary Identity Provider product has one feature all good products have – you don’t need to worry about the underlying technology, protocols, tokens.

![miniOrange Identity Brokering](/blog/assets/2023/atlassian-miniorange-identity-brokering.webp)

Our Identity broker service hides all the complexity of these protocols and provides a simple HTTPS endpoint for parties to use. Without implementing SAML, OpenID, OAuth, or OpenID Connect, you can suddenly start speaking these languages and have access to identity and access tokens from hundreds of providers. The only thing you will need to know is how to call an HTTPS endpoint which is much simpler than understanding different standards. This is similar to users’ experience for Atlassian Access SSO when connecting to a SAML Identity Provider.

On the miniOrange side, you must configure

1. **Atlassian Access SAML SSO Application** as a **Service Provider** and **miniOrange** as an **Identity Provider**.
2. **OAuth or OIDC Provider** as an **Identity Source** in **miniOrange** where **miniOrange** is the **OAuth Client** to enable OAuth SSO or OIDC SSO for easy login.

Once the connection is successful, you are good to go. You can refer to this [document](https://idp.miniorange.com/what-is-identity-brokering/) for end-to-end setup.

Using miniOrange Identity Broker Service, you can also connect multiple Providers or add user directories. You can enhance Atlassian Cloud security by enabling Secure login with Two Factor Authentication (2FA) or [Multi-Factor Authentication (MFA)](https://idp.miniorange.com/what-is-identity-brokering/) in miniOrange.

What do you think about this solution? Do you think this would be helpful for Cloud users trying to authenticate from an external OAuth Provider?

Please drop us a mail at info@xecurify.com or raise a ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.

You can learn more about our Identity Brokering features here – https://www.miniorange.com/identity-broker-service

You can take a tech deep dive into the solution here – https://idp.miniorange.com/what-is-identity-brokering/


Atlassian Cloud offers competitive pricing, especially for small user-tiers. Here comes Atlassian Access an enterprise-grade subscription for your SSO needs.

atlassian Cloud

Double-Up your Atlassian Security with MFA!

Atlassian’s Server License Discontinuation: What are your options?

Secure Atlassian Cloud with Single Sign-On (SSO) & 2FA/MFA

Log into Atlassian Cloud using External OAuth/OIDC Provider