Confluence and Jira Questions - Two-Factor and Data Encryption

[Kevin Lu]

Dear Confluence and Jira Experts,

I just got off a team meeting and the manager wants me to find out two things,

1. For Confluence's space, is there a way to set to a group of users and set up additional authentication check, say password or token (sent to user's email)?

2. For Confluence and Jira, how do we find out where the data is stored? Also, we need to find out the data encryption of the data (files, folders etc) we uploaded to Confluence and Jira.

Thanks!

Kevin

[Nic Brough -Adaptavist-]

Welcome to the Atlassian Community!

1. Yes, you would need to implement some form of multi-authenticator access.  Assuming you are not using Atlassian Access, see https://support.atlassian.com/atlassian-account/docs/manage-two-step-verification-for-your-atlassian-account/
2. For Cloud systems, see https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/

[Kevin Lu]

Dear Nic,

Thank you for your reply.

For the first question, what I mean is assuming the users have already logged into their account and when they get to a space on Confluence, it again requires them to do the multi-authentication (or input their login password again) in order to prove they're the real people who have access to the space.

For the second question, I didn't get it working as my organization's URL is https://confluence.[organization_name].ca but the request says I must input atlassian in the URL. In this case, what do I do?

[Nic Brough -Adaptavist-]

Ah, I see.

1.  I am sorry.  I missed reading the "in a space" bit at the beginning and jumped straight into MFA.

This cannot be done on a space by space basis on Cloud.  MFA is a global setting.

2. I gave you that link because you selected Cloud when telling us about your system.  The URL you've given is for a Server or DC installation. 

This will be being hosted by your organisation, so for both location and encryption settings, you need to ask your administrators.  (For what it's worth, a .ca domain means it is likely to be in Canada, or at least an AWS/Azure/Google region that covers Canada)

So, on the MFA, you can get close on Server/DC.  There are a number of MFA-enabling apps for Atlassian servers, and most of them allow you to divide your users into two groups;  "Must use MFA" and "Does not need MFA".

If you make sure the users in the first group do not have "view space" in the spaces you want to protect with MFA, you've got the protection you need.  But in a different shape.

There is another option, which is to implement this in the network rather than Confluence.  I have actually managed to do this, but I got a lot of help from two people who helped write Apache, and I don't think I could replicate it again.  What we did was move the MFA into the Apache we were using as a proxy in front of Confluence.  In there, we built a set of rules that said "If URL requested is https://ourconfluence.ourorg.com/spaces/<spacekey>/*, then demand MFA, if it's not already been done by this user".  (We did it for the admin sections as well)