
### Double-Up your Atlassian Security with MFA! {#double-up-your-atlassian-security-with-mfa}

miniOrange stands as a reputed partner and provider of security and SSO solutions for multiple platforms being WordPress, Joomla, Shopify, Drupal & many more, within the industry. Built on a strong foundation of security fundamentals, we provide secure and reliable Identity and Access Management (IAM) solutions that integrate seamlessly with the customer’s existing frameworks. We provide SSO solutions for all the Atlassian applications using protocols like SAML, OAuth 2.0, OIDC, etc. SSO enables users to securely authenticate with multiple applications by logging in only once – with just one set of login credentials. miniOrange has grown from its initial size of 4 to 150+ now. The company was built from the ground up by a group of experienced technology architects, with a background in security themselves.


Unwilling to continue in their day jobs, the team began miniOrange. Having a deep understanding of security, the miniOrange team applies their technical expertise to create unique and helpful solutions to the needs and challenges of the industry. The company aims to give organizations the ability to securely manage access to all of their web based applications in one place. We are growing day by day and will continue to do so!

&nbsp;&nbsp;

The miniOrange’s expertise in Identity And Access Management (IAM), Single Sign-On, Multi-factor Authentication, Network Security, API Security, Cyber Forensics. The central focus of our products and company revolve around these themes. Our solutions are specific, accurate and, most importantly, great at doing what they’re supposed to: Making you more secure!


### What is MFA/2FA ? {#what-is-mfa/2fa}

Multi-Factor Authentication (MFA) is an authentication method that requires the user to authenticate themselves for two or more factors, in order to gain access to company resources, applications, or a VPN. Enabling Multi-Factor Authentication (MFA) means that users need to provide additional verification factors apart from their username and passwords. These second-factor methods can range from OTP over SMS, OTP over Email, Push notification, Google/Microsoft authenticator, and many more. 

&nbsp;&nbsp;

Having this extra layer of security ensures that the information being accessed is well protected from activities such as phishing, malware, hacking, and many more. Having a strong MFA setup ensures a robust Identity and Access Management (IAM) for your organization and secures your resources.

![2fa](/blog/assets/2023/configure-two-factor-authentication.webp)


The goal of leveraging MFA is to boost security and make a layered defense so that even if one factor (username-password) is stolen, the cyber attacker still has at least one more barrier to breach before successfully breaking into the actual targeted device. The second barrier is also usually harder to breach as compared to simple username passwords.

### How does it work? {#how-does-it-work}

One of the first steps of access control is the identification and authentication of users. There are three common factors used for authentication:

- Something you know (such as a password)
- Something you have (such as a smart card)
- Something you are (such as a fingerprint or other biometric method)

Identification occurs when a user professes an identity (such as with a username), and authentication occurs when users prove their identity. For example, users are authenticated when they provide both their username and correct password. Permissions, rights, and privileges are then granted to users based on their proven identity.

![MFA](/blog/assets/2023/mfa.webp)

### Our Products {#our-products}

![products](/blog/assets/2023/our-mfa-products.webp)

&nbsp;&nbsp;


We offer MFA for Server, Data Center & Cloud. 

- For Server & Data Center, it’s available for **Jira, Confluence, Bitbucket, Bamboo & Crowd.**
- For Cloud, we have a solution available for **Jira, Confluence and Bitbucket.**

### Features Our MFA Addons Provide {#features-our-mfa-addons-provide}

#### Supported MFA Methods

We have highest number of supported methods for MFA:
Mobile Authenticator (TOTP)

1. OTP over Email
2. OTP Over SMS
3. Hardware Token (Yubikey)
4. WebAuthn
5. Duo Push Notification
6. Backup Methods
7. Security Questions
8. Backup Codes

Admin options for User management

1. Enable 2FA for Jira Software and/or Jira Service Desk
2. Choose 2FA methods for end users
3. Enable, Disable & Reset 2FA for users 
4. Enable 2FA based on groups
5. Skip 2FA for a specific group

### Security {#security}

#### 2FA for Jira Service Desk 

2FA for Service Desk is the most used feature of our addon. In organizations, there are two types of users – one is employees and the other is customers. 

The employees use multiple applications (Jira, Confluence, Bitbucket, Jenkins, Sonarqube, etc) and usually there is one central application used to manage all the users at one place, which is known as an IDP(Identity provider). So organizations connect all the applications to the IDP and users login using Single Sign on. And along with Single sign on, they also enable second factor authentication on the IDP itself. 

In Jira Service Desk, as the customers are unlicensed users, they are usually managed on the Jira itself. We allow 2FA for those customers as well. 


#### Brute Force Protection

Brute Force Attacks are hacking methods that use trial and error methods to guess user credentials and gain unauthorized access. 

In the case of 2FA,  there are Brute Force 2FA Attacks. Here hackers first get the credentials and then try all the combinations of the OTP code (which is generally 6 digit) to gain unauthorized access.

Using the Brute force protection feature, you can restrict the number of continuous invalid 2FA attempts, making it impossible for the hacker to guess the OTP.

### Usability {#usability}

#### IP Whitelisting 

Here you can whitelist a range of IPs and the plugin will skip 2FA if the user is trying to login there which improves the usability of users. 

During the pandemic many organizations introduced 2FA. As employees started working from home, they were no longer logging in from the secure company’s Network. So it becomes easier for intruders to get into systems. And to solve this issue, they introduced 2FA. 

Here the IP whitelisting feature helps improve the usability of the employees. The admin can whitelist all the IPs inside the company network. So now if an employee tries to login from within the company’s network then 2FA will be skipped for that user. And if the same user tries to login to Jira from home (via some other laptop or from mobile phone) then the 2FA will be enforced.

#### Remember My Device

This feature helps a user mark some devices as trusted devices. 

So from next time 2FA will be skipped on that device for that user. So users don’t have to enter the 2nd factor again and again.

### 2FA For Atlassian Cloud {#2fa-for-atlassian-cloud}

To enable MFA on Atlassian cloud, you need Atlassian Access. It is a separate module created by Atlassian to provide functionalities like Single Sign on, 2FA and user management for all the cloud applications.

It supports two 2FA methods.

- Mobile Authenticator
- Backup Codes.

If these 2FA methods are sufficient to your organization then you can directly use Atlassian Access. 

**There are two limitations in Atlassian Access:**

1. It supports only 2 basic 2FA methods.
2. It does not allow using SSO and 2FA at the same time for a user.
miniOrange cloud 2FA solution overcomes these limitations. There are a total 3 important use cases where miniOrange cloud 2FA solution will be used:

**Case 1:**

Suppose you are already using 2FA methods like OTP over Email in your organization and you want to enable the same for Atlassian Cloud apps. Then Atlassian Access won’t be sufficient. Here you can use the miniOrange solution where almost all the 2FA methods are supported.

![2fa-methods](/blog/assets/2023/methods-of-2fa.webp)

**Case 2:**

Second case is, your users are stored on an Identity Provider(IDPs), your users login using SSO into Atlassian Applications and you want to enforce 2FA for your users. As Atlassian Access does not allow SSO and 2FA at the same time, it adds a compulsion on Identity Providers to have inbuilt support for Two Factor Authentication. But even many popular Identity Providers like ADFS, Keycloak, Auth0 and Shibboleth don’t support 2FA. Here miniOrange Identity Broker Solution can be used.

![atlassian-cloud](/blog/assets/2023/atlassian-cloud.webp)

**Case 3:**

Third case is, your users are stored on an IDP and your IDP supports 2FA as well. But it does not support the 2FA method that you want, (which you are already using in your organization).

**Contact:  atlassiansupport@xecurify.com**
**Visit: [www.miniorange.com/atlassian](https://www.miniorange.com/atlassian)**

Multi-Factor Authentication (MFA) is an authentication method that requires the user to authenticate themselves for two or more factors, in order to gain access to company resources, applications, or a VPN.

Double-Up your Atlassian Security with MFA!


Typing out passwords takes an average of **14 seconds**, and if you're doing this for multiple desktop apps daily, it adds up fast. Desktop apps, also known as thick client apps, run on your system without needing external network or server support.  

Despite **91%** of people knowing that reusing passwords is a security risk, many still do it, often storing them in unsafe places like notes or documents. This highlights the need for a robust and secure system that not only eliminates the hassle of remembering and manually entering passwords but also stores them securely while authenticating users quickly and efficiently. This is where **single sign-on (SSO) for thick client apps** comes into play.  

Thick client SSO allows users to sign in with a single click from an intuitive dashboard for their desktop applications. The login credentials are securely stored and are not revealed to the user. Many organizations find this essential for meeting cybersecurity [compliance](https://www.miniorange.com/compliances/) and enhancing employee experience and productivity.

## What is Thick Client SSO for Desktop Applications? {#what-is-thick-client-sso-for-desktop-applications?}

Thick Client SSO is a robust solution designed specifically for desktop applications. Unlike web-based [SSO](https://www.miniorange.com/products/single-sign-on-sso), it manages authentication directly on the client side, providing seamless access across various desktop apps. This approach is particularly beneficial for organizations relying heavily on desktop software, as it enhances both security and user experience.

**Advantages of Thick Client SSO:**  

**1. Qualify Cybersecurity Audits with Compliance Support:** Thick client SSO provides a comprehensive record of all user login attempts, granting visibility into access patterns and facilitating compliance with regulations like **[GDPR](https://www.miniorange.com/compliances/gdpr), HIPAA, and PCI DSS**. By reducing the number of systems where sensitive data is accessed, thick client SSO helps minimize the risk of data breaches and ensures compliance with data privacy laws.  

**2. Shield Against Rising Security Threats with Better Security:** All authentication processes are handled by a single, trusted authority, reducing the risk of credential theft and unauthorized access. SSO can enforce stricter password policies, such as requiring complex passwords, regular changes, and [multi-factor authentication](https://www.miniorange.com/products/multi-factor-authentication-mfa), further enhancing security. By consolidating authentication, SSO can help identify and mitigate security threats more effectively.  

**3. Kill Password Fatigue with Improved User Experience:**
Users only need to remember one set of credentials, simplifying the login process and reducing frustration. SSO enables users to seamlessly navigate between multiple applications without having to re-enter their credentials, improving productivity and satisfaction. By eliminating the need to manage multiple passwords, SSO helps reduce password fatigue and the associated risks of compromised accounts.

**4. Cut Down Wasted Login Time to Boost Productivity:**
Users can quickly access the applications they need without being hindered by multiple login screens and password entry. SSO can reduce the burden on IT support by minimizing the number of password reset requests. By streamlining the login process, SSO can help users focus on their tasks and improve overall workflow efficiency.

**5. No More Password Reset Tickets with Simplified IT Management:**
IT administrators can manage user access policies and privileges from a single location, simplifying the process of granting and revoking permissions. SSO can enforce consistent security policies across all applications, ensuring compliance with organizational standards. By automating [authentication](https://www.miniorange.com/products/authentication) and access control processes, SSO can reduce the IT department's workload and free up resources for other tasks.


### Thick Client SSO Protocols {#thick-client-protocols}
Implementing Single Sign-On (SSO) for thick client applications involves using specific protocols to ensure secure and seamless authentication. Here are some key protocols commonly used:  

**1. Kerberos:**
This is a network authentication protocol designed to provide strong authentication for client-server applications by using secret-key cryptography. It's widely used in enterprise environments.

**2. NTLM (NT LAN Manager):**
An older protocol used for authentication in Windows environments. While it's less secure than Kerberos, it's still used in some legacy systems.

**3. OAuth 2.0:**
A modern authorization framework that allows applications to obtain limited access to user accounts on an HTTP service. It's often used in conjunction with [OpenID Connect](https://www.miniorange.com/iam/solutions/oauth-single-sign-on-sso) for authentication.

**4. OpenID Connect (OIDC):**
An identity layer on top of OAuth 2.0, allows clients to verify the identity of the end-user based on the authentication performed by an authorization server.

**5. SAML (Security Assertion Markup Language):**
An XML-based protocol that uses security tokens containing assertions to pass information about a user between an identity provider and a service provider.  

For thick client applications, integrating these protocols typically involves configuring the application to communicate with an [identity provider (IdP)](https://www.miniorange.com/blog/what-is-an-identity-provider-idp/) that supports these standards. This setup ensures that users can authenticate once and gain access to multiple applications without needing to log in again.


### Step-by-Step Guide to Implement SSO for Desktop Apps
Here is an implementation workflow for single sign-on for desktop applications:

**1. Assessment and Planning:**
- Identify all native desktop applications requiring SSO.
- Evaluate current authentication methods and security policies.
- Define SSO requirements and success criteria.  

**2. Choosing the Right SSO Solution:**
- Select a robust Thick Client SSO solution like miniOrange Thick Client SSO.
- Ensure it supports necessary protocols (e.g., SAML, OAuth) and integration methods.

**3. Implementation Process:**
- Set up the SSO identity provider (IdP).
- Configure each desktop application as a service provider (SP).
- Establish trust between the IdP and SPs.
- Implement necessary APIs or SDKs for seamless integration.

**4. Testing and Deployment:**
- Conduct thorough testing in a controlled environment.
- Perform user acceptance testing (UAT) with a pilot group.
- Plan a phased rollout to minimize disruption.

**5. User Training and Support:**
- Provide clear documentation and training materials.
- Offer support channels for user questions and issues.

**6. Monitoring and Optimization:**
- Implement logging and monitoring for SSO activities.
- Regularly review and optimize SSO performance and security.


### Resolving Challenges in Implementation of SSO for Thick Clients {#resolving-challenges-in-implementation-of-sso-for-thick-clients}

Troubleshooting SSO and its integration challenges for native desktop apps needs careful intervention into aspects such as:

#### **1. Legacy Application Integration:**
Integrating legacy applications that don’t support standard SSO protocols can be challenging. This can be addressed by using SSO gateways or developing [custom connectors](https://www.miniorange.com/sso-connector-pricing).

#### **2. Offline Access:**
Providing offline access can be solved by securely caching tokens locally and implementing token refresh mechanisms.

#### **3. Multi-Factor Authentication (MFA):**
Integrate multi-factor authentication (MFA) seamlessly with SSO for enhanced security.

#### **4. Performance Concerns:**
To maintain a smooth user experience, performance optimization is crucial. This involves optimizing token handling, implementing caching, and using asynchronous operations to minimize latency.


### miniOrange SSO Solution for Desktop (Thick Client) Apps {#miniorange-sso-solution-for-desktop-apps}

miniOrange Thick Client SSO offers a comprehensive solution for organizations looking to implement SSO for their [desktop applications](https://www.miniorange.com/iam/content-library/admin-docs/how-to-add-desktop-app):

- **Wide Compatibility:** Supports various desktop applications and platforms.
- **Advanced Security Features:** Includes MFA, adaptive authentication, and encryption.
- **Customizable:** Tailored to meet specific organizational needs and compliance requirements.
- **Scalable:** Designed to grow with your organization, supporting numerous users and applications.
- **Easy Integration:** Provides APIs and SDKs for seamless implementation.


### Desktop App Thick Client SSO for Organizations {#desktop-app-thick-client-sso-for-organizations}

Implementing Thick Client SSO for desktop applications can turn into efficient organizational security and productivity. By centralizing authentication and simplifying access, you're not just enhancing security – you're paving the way for a more efficient and user-friendly digital workspace.  

With solutions like miniOrange Thick Client SSO, organizations can confidently overcome identity management challenges in desktop environments. Start your journey towards seamless, secure desktop access today and experience the transformative power of Thick Client SSO. Request a free trial for miniOrange thick client SSO today!  


&nbsp;  


### Related Reading {#related-reading}

- [What is Single Sign-On (SSO)?](https://www.miniorange.com/products/single-sign-on-sso)
- [How to Choose the Right SSO Solution for your business?](https://www.miniorange.in/iam/solutions/sso-solution)
- [How to Secure Enterprise Apps with SAML SSO Authentication?](https://www.miniorange.com/iam/solutions/saml-single-sign-on-sso)
- [How to Implement SSO for OAuth Supported Apps?](https://www.miniorange.com/iam/solutions/oauth-single-sign-on-sso)





Learn how SSO for thick client apps work, what it is and how it offers the convenience of SSO for desktop apps with thick client SSO.

Double-Up your Atlassian Security with MFA!

Thick Client SSO Solution