JIRA and Azure AD + MFA

[Humberto Gomes]

New Business challenge:

I need to configure our JIRA server to connect our users via Azure AD and MFA.
Azure already has MFA configured, so probably this is solved, it is needed to select the best option to connect with Azure.

I can see some apps in the market but are they the best solution?
Have Jira already an integrated solution?

Can you share your experience?

Humberto.

[Humberto Gomes]

I found this article:

https://www.atlassian.com/blog/enterprise/openid-connect?utm_source=product-announcement-email&utm_medium=email&utm_campaign=P%3Ano-product%7CO%3Aserver%7CF%3Aconsideration%7CC%3Ablog%7CH%3Afy20q3%7CI%3Aopenid-connect%7CY%3As2dc%7CE%3Adc-server%7CR%3Agsb%7C&leadid=3502248&programid=1890&mkt_tok=eyJpIjoiTmpabE5qSmxNV1EwWkRNeiIsInQiOiJLNWJza1I5b3ZYUGJScWswUGxTZ2ZleWg5ZEprNXg2QzAwZWFjTXpCS0VIb2tcL3h3NlJOY3BsZ3RJVEZKeXVoejk3YVIzQzhsUlFTd2NxMk5ERWFSNnIxS0luU0dCXC9cL2tOeWhcL3Z6RGRuSWJjU3J5ckt6d3lsMVUx...

is this only for Data Center?

OIDC can be a solution.

We have Server version.

Someone to help?

[Christian Reichert (resolution)]

DC only - sorry.

[Jon Espen Ingvaldsen Kantega SSO]

@Humberto Gomes The article you found explains the benefits of OpenID Connect (OIDC) very well, and it is a modern alternative to SAML. In practice, the two protocols have many similarities, but OIDC is built on top of OAuth 2.0 and use more modern web technologies (JSON and REST rather than XML and SOAP). It also include the ability ask for user consent before personal data is accessed.

Kantega SSO Enterprise supports SSO with MFA for both OIDC and SAML. We have published a step-by-step guide for how to integrate AzureAD and Jira with OIDC here: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/11993089/Azure+AD

If is also a good advice to disable traditional logins mechanisms to Jira when AzureAD is set up with MFA. You find a guide for how to enforce SSO here: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/1868002/Forced+SSO+and+MFA  

Cheers,
Jon Espen 
Kantega SSO

[Christian Reichert (resolution)]

Hi!

There is no real need to do this via Crowd - there are a variety of paid plugins for Server that allow you to directly authenticate against Azure AD. That authentication then also includes the MFA from Azure AD.

If you like have a look at our plugin, which is most used one in the marketplace: https://marketplace.atlassian.com/apps/1212130/saml-single-sign-on-sso-jira-saml-sso?hosting=server&tab=overview

Here are also out Step-by-Step Guides & tutorial videos that Guide you trough the Azure AD Setup: https://wiki.resolution.de/doc/saml-sso/latest/jira/setup-guides-for-saml-sso/azure-ad

If you like to see all the other Plugins in the Marketplace - here is a search for SAML: https://marketplace.atlassian.com/search?query=saml

Cheers,
Chris

P.S. Full disclosure, I work for resolution, a marketplace vendor.

[Moses Thomas]

@Humberto GomesI have been waiting also for this ,  to make this  happen,  you would need to  Integrate JIRA server  with  Atlassian crowd (SSO)  and currently Crowd  does not support MFA

• Read more here  https://confluence.atlassian.com/crowd/configuring-azure-active-directory-935372375.html
• Ticket request to  Atlassian to  implement  https://jira.atlassian.com/browse/CWD-5322
• There are also  answers on Paid Plugins which  could do this see here https://community.atlassian.com/t5/Crowd-questions/Crowd-Azure-AD-MFA-Plugin/qaq-p/1243238

Kind regards,

Mo