Login difficulties for local users

[Maro Hamamjyan]

Hello,

Our users are claiming because when they change their passwords, they are not able to access the environment using any browser. The problem is that they save their passwords and when the windows password is being changed, browser still remembers the old one, so every time we need to delete all browsing data in the browsers and ask them to re-enter their username and password. This is a real problem specially when users are managers, please suggest a solution, Who has solved this problem?

We use AD and get our users from there.

Thanks in advance

[Jon Espen Ingvaldsen Kantega SSO · Accepted solution]

I would strongly recommend Windows Integrated Authentication ( also known as Kerberos) if you use Microsoft AD. With this SSO protocol, your users are automatically logged in to Jira based on their windows session tickets.

There are two vendors offering Windows Integrated Authentication to Jira:

1) Kantega SSO (the company I work for), and
2) Techtime - EasySSO.

Please contact us if you need help configuring Windows Integrated Authentication for your environment.

Cheers,
Jon Espen

[Maro Hamamjyan]

Hi Jon,

Thanks for your reply. We use Microsoft AD, but do not have ADFS. Will the add-on you suggest work with that? Also, when the password is changed for a user in AD(our users regularly change their passwords), will it get the new password and open the page without bringing at error?

[Jon Espen Ingvaldsen Kantega SSO]

You will not need ADFS to setup Windows Integrated Authentication (WIA), and AD supports this out-of-the-box.

In this authentication, users are authenticated in Atlassian based on valid windows session tickets on the local machines (and not based on their password). 

When the password is changed for a user in AD, he / she will still be automatically authenticated.

Note that, WIA requires users to work on trusted networks. If they login-through a remote network (ex. work from home or out traveling) they need to login traditionally through username / password or SAML SSO. For SAML, your would need an Identity provider such as AD FS or Azure AD.

WIA does not help updating remembered passwords in the browsers, but, to a large extent, it eliminates the problem and gives users a much better login experience :)

-Jon Espen

[Kat Warner]

Thanks for the shout out @Jon Espen Ingvaldsen Kantega SSO

[Maro Hamamjyan]

Hi Jon,

Thanks for nice explanation. I want to try the add-on, as far as I understand I should choose SSO with Kerberos option for configuration. hopefully no questions will raise during configuration, but in case they occur should I write you or open a ticket for vendor (I think in any case you re going to answer me).

[Maro Hamamjyan]

Hello Jon,

Can you please help me to find the place where I can configure the IPs in the plugin?

[Jon Espen Ingvaldsen Kantega SSO]

Hi Maro. 

This is a bit strange. It looks like the addon does not have a valid license, event though the we are not yet in March.

What happens if you press "enable"?

Regards,
Jon Espen

[Maro Hamamjyan]

Hi Jon,

I have already generated an evaluation licensee, as you may see in the screen shots it says that my trial will expire 13/March/19 only.

[Maro Hamamjyan]

I do not want to enable it till I didn't configure the IPs

[Nic Brough -Adaptavist- · Accepted solution]

There's nothing you can do about this, other than get the users to stop saving their passwords in the browser.  It's not a Jira behaviour, it's the browsers.

[Maro Hamamjyan]

In case they do not save their passwords in browsers they have to enter their logins and passwords browsers every time.. it would be perfect if jira did not ask customers to enter their logins and passwords, it could just get the user from AD automatically

[Nic Brough -Adaptavist-]

Yes, that's basic security and access control.

It sounds like you want to have some form of automatic login, such that someone logs into your AD once, and their computer keeps a token that can be used to log in to other systems without asking again.

This is called "Single Sign On" (SSO), and is not something most systems support automatically.  You will need to find and add an App to Jira to enable it (or use Crowd for your user directory, as it's built into that)

[Maro Hamamjyan]

Thanks Nic, an add on is a good idea!

[Jon Espen Ingvaldsen Kantega SSO]

Hi Maro. You have to enable the add-on to get the configuration features. 

It is, however, possible to also enable / disable IDPs after they are configured.

We can follow the dialog further on mail.

Best,
-Jon Espen

[Maro Hamamjyan]

I Jon, Can you please write your email address?