2FA - User's guide
Two Factor Authentication(2FA) is an extra step added to your log-in process. It enhances your security by one level and protects your Jira account from cyber criminals.
Two factor authentication uses two factors to verify your identity and to confirm that you are who you claim to be. It uses a combination of something you know and something you have. So here the 1st factor of authentication is your usual Jira login with username and password, it is something you know. The 2nd factor will verify something that only you have, like your mobile phone, your email account, a hardware token given to you by your company, etc.
The add-on verifies this 2nd factor. The most commonly used 2FA methods are Mobile authenticator Authenticator(TOTP), Hardware token(yubikey), OTP over email, Security questions, Backup code. So a time sensitive security code is sent to the user using any of these ways and the user can securely log into Jira.
In this guide we will go through how to get started with 2FA.
How to Configure Mobile Authenticator(TOTP):
Follow these steps for initial configuration of mobile authenticator 2FA.
Step 1: Download an authenticator app on mobile.
For using the mobile authenticator 2FA methods, you will need an Authenticator app on your mobile or any device to scan the QR code. Google Authenticator is the most popular authenticator app. (Here are the links for Google authenticator app: Google play, App store)
You can use other apps like Microsoft Authenticator, Authy, Duo , LastPass, FreeOTP, Symantec VIP, etc.
Contact your administrator if you are not sure about what authenticator application to download.
Note: The Mobile authenticator(TOTP) 2FA method is a time based authentication method so make sure that your device is in sync with the Network time. (On Android device, enable 'Automatic Date and time' and on iOS device, turn on 'Set Automatically' option in the date and time settings)
Step 2: Scan the QR code.
Open your authenticator app on your mobile/device and click on Scan a QR code.
If your device asks you to allow Authenticator to take pictures and record video, press Allow. This is required to scan the barcode using your phone's camera.
Then scan the QR code given on the login page by placing the QR code within red lines.
Step 3: Enter the Verification code generated on the mobile.
When you scan the QR code, the Authenticator app will generate a verification code. The code is valid for only a certain time and once the code expires, you will see a new code.
Copy that code and enter it in the Enter OTP field on the Jira Login page. Then Click on the Validate button.
How to Configure Backup Codes:
Once you have configured the primary 2FA method then you will get redirected to Backup codes configuration page. On this screen you will see 15 unique backup/recovery codes.
In future, in case if you lose your phone, then you can use these recovery codes to gain access to your account again.
Click on the Download Codes button and click on Continue. Then store the downloaded file with backup codes at a secure location.
Each backup codes can used only once. If you have used many backup codes then, if you want, you can download a new set of backup codes as well. For this, log into your account and go to the Two Factor Configuration page on your profile.
Then click on show details for Backup codes and you will see this popup. Click on Change Backup Codes button and Download the codes again.
If you are looking for anything which you cannot find, please drop us an email on firstname.lastname@example.org