
## Duo push notification and webauthn as 2FA for atlassian apps {#duo-push-notification-and-webauthn}

Your accounts are password protected but they might still not be secure. Hackers out there are lurking to hack into your accounts by taking advantage of weak passwords, vulnerabilities, or leaks in data.

We have got you covered!

All you have to do is install [Two Factor Authentication](https://marketplace.atlassian.com/search?query=two%20factor%20authentication%20miniorange) app and leave the rest to us.

[Two Factor Authentication](https://marketplace.atlassian.com/search?query=two%20factor%20authentication%20miniorange) also known as two-step verification adds an additional layer of security to your already existing authentication credentials namely username and password. Any unauthorized access to your account is restricted to a large extent by making it more difficult to hack into an account. 2FA is not provided by Atlassian in Server and Data Center versions and hence you can use miniOrange’s two factor authentication app to strengthen your Jira and Confluence access and avoid losses due to passwords.

Our miniOrange app provides various 2FA authentication methods like OTP over email, OTP over SMS, Google authenticator, Security questions, Yubikey hardware token, WebAuthn (Windows Hello/Apple ID), etc.

We have recently introduced the support for Duo Push Notifications. It is one of the popular 2FA methods.

### What makes Duo Push Notification so special and different from other 2FA methods? {#what-makes-duo-push-notification-so-special-and-different-from-other-2fa-methods}

OTPs, security questions, authenticators, hardware tokens, etc, all require the user to enter a one-time code or some form of text to authenticate the user and let him or her log into their Jira or Confluence. Since this is an extra effort on the user’s end, it increases the resistance and reduces adoption of Two factor authentication by users.

With Duo Push Notification your users don’t need to wait for a code or OTP and type it. Instead they will just tap the tick mark and the authentication is done.

Duo Push Notification is a feature of the 2FA mobile app, Duo. When any user initiates a request to access an account by entering their username and password, Duo app sends a push notification to the user’s device where they simply need to Accept or Reject the request. This way you are using another device and increasing the security multifold. And the way in which authentication is being done is convenient and hassle-free for the users.


### Now that’s easy hassle free and effective isn’t it? {#now-that’s-easy-hassle-free-and-effective-isn’t-it?}

It is the fastest and the easiest way to log in securely into your accounts. As there are no codes or OTPs in Duo Push Notification that the hackers can steal and hence Duo Push is very effective against man-in-the-middle attacks.

Now, I am not saying that the other two factor authentication methods aren’t good but let’s say you are a bit lazy and you don’t feel like entering the OTP sent over SMS, Email or Google authenticator then Duo Push Notification is just for you.

We also provide another Two Factor Authentication method known as **Webauthn** which is just as convenient and secure as Duo Push Notification.

### What is Webauthn? {#what-is-webauthn}

WebAuthn enables users to authenticate via third-party authentication providers. An authentication provider is a system like Windows Hello, Apple ID, Android biometrics, or even an external device, like a hardware token which can be used to allow users access to the system.

Our 2FA app lets users use authentication providers like Windows Hello as a second method of authentication. It is also a very convenient way as users already use it. No adoption is required &  users don’t need to switch devices, which they do while using other methods like OTP.

![Webauthn](/blog/assets/2023/duo-push-notification-and-webauthn.webp)

Let’s understand the above diagram –

**Passwords** – Passwords might not always be secure but it also comes with the inconvenience of remembering many passwords and typing them every time you login. They can be compromised easily as people tend to reuse the passwords at many places.

**OTP** – One time password or OTP is one of the secure methods of authentication but it seems a bit inconvenient as one has to wait for the OTP to arrive or open the app and then type it down.

**Push Notifications** – Duo Push Notification is one of the most secure and convenient of all the two factor authentication methods as you just have to Allow or deny the request.

**WebAuthn** –  xWebauthn is another secure and most convenient authentication method as it helps you authenticate via the same workstation.

To know more about two factor authentication and how to protect your Atlassian applications check out our previous blogs :-

1. [Secure your Jira with 2FA (OTP over SMS/ Email)](https://blog.miniorange.com/secure-your-jira-with-2fa-otp-over-sms-email)
2. [Double-Up your Atlassian Security with MFA!](https://blog.miniorange.com/double-up-your-atlassian-security-with-mfa/)
3. [How to secure Atlassian cloud applications](https://community.atlassian.com/t5/Atlassian-Access-articles/How-to-secure-Atlassian-Cloud-Applications/ba-p/1728600) 
4. [Enable 2FA on Jira for your Customers and skip 2FA for Employees!](https://community.atlassian.com/t5/Jira-articles/Enable-2FA-on-Jira-for-your-Customers-and-skip-2FA-for-Employees/ba-p/1719062)a

Duo Push Notification your users don’t need to wait for a code or OTP and type it. Instead they will just tap the tick mark and the authentication is done.

Duo push notification and webauthn as 2FA for atlassian apps


## Log into Atlassian Cloud using External OAuth/OIDC Provider

Atlassian Cloud has become very popular in the last couple of years. It offers competitive pricing, especially for small user-tier applications. Since the announcement of Server discontinuation by Atlassian, more and more customers are moving to Cloud and Data Center. You can check out our article to see if Atlassian Cloud is a good option for you here – [Atlassian’s Server License Discontinuation: What are your options?](https://community.atlassian.com/t5/Atlassian-Cloud-Migration/Atlassian-s-Server-License-Discontinuation-What-are-your-options/ba-p/1635739#)

### What is Atlassian Access? {#what-is-atlassian-access}

Atlassian Access is an enterprise-grade subscription for enhanced security that provides centralized administration and governance. Atlassian Access SSO has security controls like [SAML Single Sign On (SSO)](https://www.atlassian.com/software/access/guide/elements/single-sign-on#how-it-works), User Lifecycle Management, Active Directory Sync, and many more. All these features span across all Cloud apps inclusive of Jira Software, Jira Service Management, Confluence, Bitbucket, Trello, and Statuspage spanning over organizations giving you the ability to use Jira SSO and Confluence SSO.

![Atlassian Access](/blog/assets/2023/atlassian-access.webp)

Single Sign-On into Atlassian Access allows users to authenticate to Atlassian Cloud products through your existing SAML 2.0 Identity Provider giving you the ability to enable and use Atlassian Cloud Jira SSO and Atlassian Cloud Confluence SSO. Cloud SAML Single Sign On (SSO) provides employees with a simple and easy process for accessing the tools that they use and allows admins to enforce identity-related security controls at scale, making the task of securing large groups of users far simpler.

What if users are present in OAuth or OpenID Provider? Will SSO still work? How can we connect Atlassian Cloud (SAML SSO modules) to OAuth/OIDC Providers? Is it even possible?

**YES! It’s possible with miniOrange’s Identity Brokering Service.**

### What is miniOrange Identity Brokering Service ? {#what-is-miniorange-identity-brokering-service}

Identity brokering is a way to establish trust between any two applications that do not speak the same language. Identity Brokering is a service that connects multiple service providers with different Identity Providers. Atlassian Access only allows SAML requests & responses. If your organization uses OAuth/OIDC protocol and would like to use Atlassian Access for Single Sign-On, you’re in somewhat of a fix! This is where miniOrange Identity Brokering comes into play.

![miniOrange Identity Broker Service](/blog/assets/2023/identity-broker-service.webp)

It establishes trust between any two applications like Atlassian Access SSO (SAML) and any OAuth/OIDC Provider that does not speak the same protocol and helps them understand requests and responses. This will be equivalent to a language translator where translators understand one language and translate it into another language. While using a translator, one needs to know at least one of the languages, whereas while using our product – you do not need to worry about any of the protocols. Users will still see the same flow which they see with other apps. **On accessing Atlassian, they will see the OAuth Provider’s login page, they will not see any miniOrange page or login screen in between, so users will not notice the integration with miniOrange**.

You can use both Cloud Jira SSO and Cloud Confluence SSO through one centralized miniOrange offering. Applications that do not communicate with each other using the same protocol are known as cross-protocol applications.

Over the years we have developed many standards for doing this like SAML, OpenID, OAuth, OpenID Connect, but the problem is that very few people can get these protocols talking to each other safely and quickly. miniOrange’s Identity Brokering, built-in to our proprietary Identity Provider product has one feature all good products have – you don’t need to worry about the underlying technology, protocols, tokens.

![miniOrange Identity Brokering](/blog/assets/2023/atlassian-miniorange-identity-brokering.webp)

Our Identity broker service hides all the complexity of these protocols and provides a simple HTTPS endpoint for parties to use. Without implementing SAML, OpenID, OAuth, or OpenID Connect, you can suddenly start speaking these languages and have access to identity and access tokens from hundreds of providers. The only thing you will need to know is how to call an HTTPS endpoint which is much simpler than understanding different standards. This is similar to users’ experience for Atlassian Access SSO when connecting to a SAML Identity Provider.

On the miniOrange side, you must configure

1. **Atlassian Access SAML SSO Application** as a **Service Provider** and **miniOrange** as an **Identity Provider**.
2. **OAuth or OIDC Provider** as an **Identity Source** in **miniOrange** where **miniOrange** is the **OAuth Client** to enable OAuth SSO or OIDC SSO for easy login.

Once the connection is successful, you are good to go. You can refer to this [document](https://idp.miniorange.com/what-is-identity-brokering/) for end-to-end setup.

Using miniOrange Identity Broker Service, you can also connect multiple Providers or add user directories. You can enhance Atlassian Cloud security by enabling Secure login with Two Factor Authentication (2FA) or [Multi-Factor Authentication (MFA)](https://idp.miniorange.com/what-is-identity-brokering/) in miniOrange.

What do you think about this solution? Do you think this would be helpful for Cloud users trying to authenticate from an external OAuth Provider?

Please drop us a mail at info@xecurify.com or raise a ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.

You can learn more about our Identity Brokering features here – https://www.miniorange.com/identity-broker-service

You can take a tech deep dive into the solution here – https://idp.miniorange.com/what-is-identity-brokering/


Atlassian Cloud offers competitive pricing, especially for small user-tiers. Here comes Atlassian Access an enterprise-grade subscription for your SSO needs.