Can anyone recommend a 2FA App for Jira and Confluence that works with the Mobile apps'

[FINCAD IT Team]

I've tried the 2FA for Jiraa: U2F & TOTP plugin

I like the workflow, but only seems to secure desktop browsers. Am able to use IOS Atlassian Jira mobile app to just login without any 2FA. 

Would appreciate any suggestions for a plugin app available for Server Jira + Confluence that secures with 2FA when accessing from Mobile apps as well as Desktop

Thank-you!

[Ed Letifov _TechTime - New Zealand_]

As convoluted as it may sound, you best bet would be to integrate your Atlassian Server applications with a SAML Identity Provider (ADFS, AzureAD, G-Suite, OKTA, Ping) if it is at all possible for your users, and let the IdP handle 2FA (as well as the authentication). 

I can testify that the mobile app for Jira and Confluence do support redirects (to the SAML IdP) from the login form. The issue with an app that performs 2FA while inside the application is that on the web it does this after the login form, but beyond the login form, the mobile app "takes over" and starts using REST (which is not and can't be intercepted by the 2FA app)

We are a vendor for EasySSO - an SSO plugin that besides NTLM, Kerberos, X.509 and HTTP Headers authenticators also has the SAML authenticator, and our own on-premises installations of Atlassian applications fully support SSO with our IdP via EasySSO for Jira, EasySSO for Confluence, and EasySSO for Bitbucket.

There are other SAML apps on the market - I am sure they will be equally well up to the task.

[FINCAD IT Team]

Duly noted, we are already using AWS SSO as our SAML provider for a number of services, so it's not out of the question to implement that for our on-prem Atlassian as well.

Assume AWS SSO would work with your product as well as G-Suite, AzureAD, etc

Thank-you for taking the time to respond.

[Christian Reichert (resolution)]

Hi @FINCAD IT Team ,

a good overview of all the available Plugins that work with SAML 2.0 Providers you'll find here: https://marketplace.atlassian.com/search?query=saml

I can certainly confirm for our plugin, that we have customers who are using AWS SSO.

If you decide to give our's a spin - you can easily book a free Screenshare via https://resolution.de/go/calendly if you like to do the setup with us together.

Cheers,
   Chris

P.S. Full disclosure, I work for resolution, a marketplace vendor.

[Carlos Khatchikian]

I can answer from Jira's side. We have released in iOS the new OAuth flow which should share anything that Web has. So if web has 2FA, Mobile will have.

We are currently rolling out the same system in Android and it should be roll out in the next 30 to 45 days. 

In terms of Confluence I don't have much idea on when they are going to release OAuth but it sounds that is not any time soon. 

[FINCAD IT Team]

Thanks Carlos, unfortunately, it doesn't seem to work in Jira using the IOS app

Specifically, am using this plugin: https://marketplace.atlassian.com/apps/1220048/2fa-for-jira-u2f-totp?hosting=server&tab=overview

w/ jira 8.4.1 on prem

It is configured so that via web 2fa is required and works. However, when logging in with the IOS mobile app, password only gets me in with no 2FA prompt.

Any ideas why?

[FINCAD IT Team]

Follow up @Carlos Khatchikian  -- here's what the 2FA app support people told me, can you comment or clarify that? You are telling me it should work, and they are telling me it can't...

Thank-you

------------------------

Hello 

Thank you for your email.

Based on https://confluence.atlassian.com/jirasoftwareserver/jira-software-mobile-app-966063511.html (Third party add-ons and visual customizations):

The mobile app provides a simple, lightweight way for users to view, create, edit and collaborate on issues. Complex interactions, including those provided by add-ons, will not be available in the app.

Any look and feel customizations you’ve made to your Jira instance will not be reflected in the app.

Unfortunately add-ons from the Marketplace are not compatible with Atlassian Jira mobile application.

We really hope this will change in the future and we'll be able to roll-out mobile apps support.

Best regards,

Anton

-----------------------------

[Carlos Khatchikian]

Oops, I thought you were asking about Jira Cloud. 

(Sorry)

[FINCAD IT Team]

My fault I should have been clear in my original post it was for on prem. Thank-you for taking the time to respond Carlos