Administrator's Guide SecureLogin for JIRA

Transcription

1 Administrator's Guide SecureLogin for JIRA Add-on Installation Before you begin To install the Secure Login Plugin, you must log-in with JIRA Admin permissions Installing Secure Login via the UPM 1. Click the admin dropdown and choose Atlasssian Marketplace. The Manage add-ons screen loads. 2. Click Find new-add-ons from the left-hand side of the page. 3. Locate SecureLogin for JIRA via search. The appropriate add-on version appears in the search results. 4. Click Try free to begin a new trial or Buy now to purchase a license for SecureLogin for JIRA. You're prompted to log into MyAtlassian. SecureLogin for JIRA begins to download. 5. Enter your information and click Generate license when redirected to MyAtlassian. 6. Click Apply license. If you're using an older version of UPM, you can copy and paste the license into your JIRA instance. 7. Configure the add-on according to the following sections in this Administrator's Guide. Installing Secure Login via the Atlassian Marketplace Download the JAR-File 1. Open the Atlasssian Marketplace in your preferred browser 2. Click Find new-add-ons from the left-hand side of the page. 3. Locate SecureLogin for JIRA via search. The appropriate add-on version appears in the search results. 4. Click Try free to begin a new trial or Buy now to purchase a license for SecureLogin for JIRA. You're prompted to log into MyAtlassian. 5. Click Generate License in order to generate a new license 6. Copy the license key and click Download. 7. Save the JAR-file on your local disk. Table of Content Add-on Installation Installing Secure Login via the UPM Installing Secure Login via the Atlassian Marketplace Standard Configuration Activate "SecureLogin" after installation Reset to Google default Context-Whitelist Black / Whitelisting IP List Forward Header User Group Expert Configuration Window Timestep Secret Size Reset An User Accoun Reset An Administrator's Account Install the JAR-File 1. Click the admin dropdown and choose Add-Ons. The Manage add-ons screen loads. 2. Click Upload Add-on and select the JAR-file. The plugin is installed and displayed in the User-Installed Add-ons. 3. Enter the license and click Update. Standard Configuration In this section only the add-on will be activated with standard values. Activate "SecureLogin" after installation 1. In the Administration area select Add-ons. 2. Navigate to the SECURITY section on the left-hand side of the page (figure 1, step 1). 3. Click on SecureLogin (figure 1, step 2). 4. Click Edit configuration (figure 1, step 3). 1

2 Figure 1. Configuration of the SecureLogin Plug-in 5. Activate the checkbox Active (figure 2, step 1) and click the button Save configuration (figure 2, step 2) to activate the configuration. Figure 2. Activation of the configuration Reset to Google default You can click Reset to Google default to restore values of fields to default. Context-Whitelist The Whitelist contains comma separated context root elements, which can be accessed without authentification via the plugin. This field allows you to add or delete some titles and only titles on the list will be accepted for access without pin. Format: /path title, Black / Whitelisting Determines whether the IP List and User Group should be used as a Black- or Whitelist. IP List Comma separated list of IP addresses which have or have not to be authenticated via the plugin, depending whether Black- or Whitelisting is. selected. 2

3 Forward Header Custom forward header which can be set to identify the original IP address behind a proxy. If no value is set, the X-FORWARDED-FOR header will be evaluated. User Group User Group which has or has not to be authenticated via the plugin, depending whether Black- or Whitelisting is. selected. Expert Configuration In this section we explain the configuration with advanced values. 1. In the Administration area select Add-ons. 2. Navigate to the SECURITY section from the left-hand side of the page. 3. Click SecureLogin. 4. Click Edit configuration. 5. Click Show extended setting to show extended parameters. Figure 3. Show the extended settings The following parameters are installed with default values, which you can edit. Figure 4. Edit the extended parameters 3

4 6. Click Hide extended setting to hide extended parameters. Figure 5. Hide the extended parameters Window Window for codes to be calculated for time synchronization purposes. They search for the OTP provided by the user. This field allows you to input only positive number >=1 without any decimals, signs like percentage, currency or comma, etc. The configuration does not accept an empty field. We recommend a default Window size of 30. If it s greater than 30, the generated OTPs will be exposed a larger window to attack. If it s lower than 2, the authentication service will not find the user-generated OTP in the window. Timestep Timestep in seconds, which describes the windows step size for Synchronization. This is an integer value representing the number of seconds. This field is not editable. We recommend a default Timestep size of 30 seconds. Secret Size Number of digits of a scratch code represented as a decimal integer. We are using the default value of 8 for secret size Reset An User Account Scenario: An user cannot login to JIRA anymore, because her/his mobile device is no longer available due to whatever reason or the authenticator app has been deleted on the mobile device etc. Please execute the following steps to reset an user account: 1. Log into your JIRA instance as an admin. 2. Click the admin dropdown and choose User Management 4

5 Figure 6. Choose user management 3. Confirm the administration access. Figure 7. Confirmation of the administration process 4. Select the user by clicking on her/his name. Figure 8. Select the user 5

6 5. Click View Public Profile. Figure 9. View the public profile 6. Click Tools dropdown and choose SecureLogin Usertoken. Figure 10. Choose SecureLogin user token 7. Click Delete Token to delete the user token. Figure 11. Delete the user token Login to JIRA next time, this user will be presented a QR-Code again to connect a mobile authenticator to her/his JIRA user account. 6

7 Reset An Administrator's Account Scenario: the admin cannot login to JIRA anymore, because her/his mobile device is no longer available due to whatever reason or the authenticator app has been deleted on the mobile device etc. 1. Team solution: Another admin has to login and reset the securelogin-token for the related collegue 2. Technical solution: It is possible by executing the following steps but not recommended to reset SecureLogin-accounts via direct database access Connect to your Database with a DB administration tool Identify the USER_CONFIG table in your database. This table is named AO_<h ash>_user_config while <hash> is a 6 digit hash value. (e.g. AO_1D83D9_ USER_CONFIG) Get the account row by looking at the column USER_IDENTIFIER. This is a string containing <full username>_< address>_<login username> (e.g. Max Mustermann_mm@test.org _muster ). <full username> is the user's full name, < address> is the user's registered and <login username> is the user's login name. To reset the account, delete the corresponding data set from the USER_CONFI G table. e.g.: DELETE FROM AO_1D83D9_USER_CONFIG WHERE USER_IDENTIFIER LIKE 'Max Mustermann_mm@test.org_muster'; With the next login to JIRA this user will be presented a new QR-Code again to connect a mobile authenticator to her/his JIRA user account. 7