How to Set Up Two-Factor Authentication (2FA) for Bitbucket

The miniOrange Two-Factor Authentication (2FA) app is designed to help you enhance security for your Bitbucket. In this comprehensive guide, we will navigate you through the step-by-step process of configuring 2FA for Bitbucket. By the end of this walkthrough, you will have fortified your platform with an additional layer of security, safeguarding your registered end-users.


You can also refer to the detailed setup video provided below to set up your own miniOrange Two Factor Authentication (2FA) app for Bitbucket.


For a more comprehensive understanding and additional tips, check out our comprehensive Atlassian 2FA handbook.

Pre-requisites for Setting Up 2FA

    Before configuring the miniOrange Two-Factor Authentication (2FA) App for Bitbucket, ensure you have the following:

  • Bitbucket is installed and configured on your system.
  • Supported versions: Bitbucket Server 7.0.0 - 9.1.1, Bitbucket Data Center 7.0.0 - 9.1.1
  • Admin credentials for Bitbucket.
  • A valid Bitbucket Server or Data Center license.

Download And Installation

  • Log into your Bitbucket instance as an admin.
  • Navigate to the Settings menu and click on Manage Apps.
  • Click on Find new apps or Find new add-ons from the left-hand side of the page.
  • Use the search function to find mO Two-Factor Authentication (2FA) for Bitbucket.
  • Click Try free to start a new trial or Buy now to purchase a license for the plugin.
  • Enter your information and click Generate license when redirected to MyAtlassian.
  • Click Apply license to complete the installation.
    • Setup Two Factor (2FA / MFA) Authentication for Bitbucket using OTP, KBA, TOTP methods

1: Configuring miniOrange 2-Factor Authentication

Follow these steps to configure and enable the miniOrange 2FA app for your Bitbucket users:

  • Choose 2FA Methods: The miniOrange 2FA add-on offers users a range of 2FA methods, including OTP, KBA, TOTP, and more, for authentication. You can enable the desired 2FA methods from the provided list during plugin configuration. To enable the chosen methods for your users, you just have to select the 2FA Method option and toggle it active.

    • Setup Two Factor (2FA / MFA) Authentication for Bitbucket using OTP, KBA, TOTP methods settings
  • Enable Backup Method:To ensure access during emergencies or when users cannot access their primary 2FA method, our app also provides you with a backup authentication method. You can choose any of the listed 2FA methods as your backup by selecting the Backup Method option and toggling it active.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings
  • Select Users to Enforce 2FA: Once the required 2FA methods are enabled, select the users who will be required to use 2FA.
  • Use the Enable 2FA/MFA for All Users option to apply 2FA to all existing users and automatically enable it for newly created users.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings
  • You can customize the 2FA settings based on your requirements. Enable, disable, or skip 2FA for users or groups individually, in bulk, or based on their IP addresses.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings
  • Enable 2-Factor Authentication: Finally, enable 2FA for Bitbucket Server.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

2: How the users can configure 2FA methods



Supported Authentication Methods
Google Authenticator icon

Google Authenticator

Microsoft Authenticator icon

Microsoft Authenticator

Yubikey Hardware Token icon

Yubikey Hardware Token

OTP over Email icon

OTP over Email

OTP over SMS icon

OTP over SMS

Duo Push Notification icon

Duo Push Notification

WebAuthn icon

WebAuthn

Security Questions icon

Security Questions

Backup Codes icon

Backup Codes




3: Advanced Security Features

3.1: Brute Force Configuration

    Brute Force Configuration helps restrict access to your Bitbucket application after a specified number of invalid 2FA login attempts within a set period.
    To enable this feature:

  • Check the Enable Brute Force Protection for Bitbucket box.
  • Set the number of invalid login attempts that will trigger a lockout.
  • Define the duration for which the user will remain locked out and unable to access Bitbucket.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

3.2: Remember My Device

    This feature allows users to skip the 2FA check when logging in from the same device.
    To enable:

  • Check the Remember My Device box.
  • Enter the number of days for which the device will be remembered in the Expiry Time (in Days) field.
  • You also have the option to allow end users to change their respective expiry times.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

3.3: One-Time 2FA Validation in Crowd authentications setups

    This feature lets users skip 2FA in Crowd-connected applications after a successful 2FA validation any one Atlassian application.
    To enable:

  • Toggle this feature to enable in the crowd connected applications where you want to bypass 2FA.
  • Users will need to validate 2FA in one application, and it will be skipped in other connected applications.

    • Note: This feature is only available if authentication is done via Crowd.

    Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

3.4: Skip 2FA for Bitbucket SSO Users

    This feature allows users to skip 2FA if they log in via Single Sign On (SSO) with any Identity Provider (IDP).
    To enable this, admins need to:

  • Add the Single Sign-On URL for SAML.
  • Add the Callback URL for OAuth/OpenID from the SSO Provider.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

3.5: Skip 2FA for Crowd SSO Users

    This feature allows users to skip 2FA when logging in via SSO using the miniOrange Crowd SAML add-on and Bitbucket Crowd connector.
    To enable this, admins need to:

  • Add the Secret Key provided by the miniOrange Crowd add-on.
  • Add the Crowd SSO cookie name.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

3.6: Access to Plugin Pages

    By default, only administrators have access to the plugin pages. This feature allows you to define and customise access permissions for specific user groups, granting them the ability to view and manage designated plugin pages.
    By configuring access settings, you can ensure that the right users have the necessary permissions to perform their tasks, enhancing collaboration and security within your organization.
    To enable this, admins need to:

  • Navigate to the Advanced Options Tab and scroll down to the Access to Plugin Pages section.
  • Next, specify the Page, Group Name, and Access Type from their respective drop down lists.
  • To add more access permissions, click on Add New Access and follow the same process.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

3.7: Restrict 2FA Methods Based on Groups

    This feature gives administrators the ability to limit specific 2FA methods to certain user groups. For example, an organization might offer two login methods, such as OTP Over Email and Mobile Authenticator.
    With this feature, admins can require employees to use OTP Over Email for enhanced security, while allowing customers to select a method of their choice.
    To enable this, admins need to:

  • Navigate to the Advanced Options Tab and scroll down to the Restrict 2FA Methods Based on Groups section.
  • Next, click on Add New Method.
  • Specify the 2FA method along with the group for which it is to be restricted.
  • Finally, select a Fallback Method for the group to use if they’re not configured against any method.

    • Any enabled methods not specified in this configuration will remain available to all users by default.

    Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

3.8: Enable 2FA on REST API Calls

    This feature allows you to enforce Multi-Factor Authentication (MFA) for all REST API calls. By enabling this option, every API request requires a second form of verification, enhancing security and protecting sensitive data from unauthorized access. Users can choose their preferred verification method, ensuring a balance between security and user convenience.
    To enable this, admins need to:

  • Navigate to the Advanced Options Tab.
  • Next, scroll down to the Force 2FA on REST API calls section and enable the toggle button.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

3.9: Enable Redirection Based on Your Absolute URL

    This feature allows you to configure automatic redirection after successful 2FA authentication based on your domain name and port. If the domain name and port are not specified, the plugin will rely on the configured base URL for redirection.
    This ensures that users are seamlessly directed to the intended resource, such as a dashboard or home page, enhancing their overall experience while navigating your application.
    To enable this, admins need to:

  • Navigate to the Advanced Options Tab.
  • Next, scroll down to the Select URL type for Redirection section and enable the toggle button.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

4: User Management

    The miniOrange 2FA app has provisions for efficiently managing 2FA settings for individual users, multiple users, single groups, and multiple groups.
    Let's take a look at how you can manage 2FA for your users and groups.

Enabling 2FA for Single Users:

  • Search for the user by their name in the search bar.
  • Next, select the desired action from the Action column.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

Enabling 2FA for multiple Users:

  • Select the users from the list.
  • Choose the desired action from the Bulk 2FA Action drop-down menu.
  • Click Apply.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

Enabling 2FA for All Users:

  • Go to the Bulk 2FA Action drop-down menu under the All Users section.
  • Select the required action.
  • Click Apply.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

Enabling 2FA for Single Groups:

  • Search for the group by its name in the search bar.
  • Next, select the desired action from the Action column.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

Enabling 2FA for Multiple Groups:

  • Select the groups from the list.
  • Choose the desired action from the Bulk 2FA Action drop-down menu.
  • Click Apply.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

Enabling 2FA for All Groups:

  • Go to the Bulk 2FA Action drop-down menu under the All Groups section.
  • Select the required action.
  • Click Apply.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

5: IP Restrictions

IP Whitelisting:

  • IP Whitelisting is a security feature that allows trusted users to log into Bitbucket without 2FA. To enable IP Whitelisting, enter the trusted IP addresses in the Whitelist IP Address textbox and click Add.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

IP Blocking:

  • IP Blocking is an access control mechanism that denies Bitbucket access to specified IP addresses. Enter the IP addresses you want to block in the Blacklist IP Address textbox, and customize the message for blocked users in the Blocked User Message textbox. Click Save once you’re done to apply these settings.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

6: Reconfigure 2FA

  • End-users can reconfigure their 2FA by navigating to User Profile → Two-factor Plugin Authentication, and accessing the Configure Two Factor (2FA) window. Once inside, they can click on Reset to reconfigure the 2FA method. Users can also configure additional 2FA methods from this window if they haven't done so previously.
    • Setup Two Factor (2FA / MFA) Authentication for Confluence using OTP, KBA, TOTP methods settings

Recommended Add-Ons

Bitbucket SAML SSO

Enable Single sign on on Bitbucket using SAML SSO addon.

Know More

User Sync SCIM Provisioning

Synchronize users, groups and directory with SCIM and REST APIs for Server DC.

Know More

API Token Authentication

Secure your Bitbucket Data Center/Server REST API using API Tokens.

Know More


Free Trial

If you don't find what you are looking for, please contact us at support-atlassian@miniorange.atlassian.net or raise a support ticket here.