Dual two-factor authentication

Question

We have a local Confluence installation with Duo 2FA enabled. Is it possible to install a second 2FA service, and then enable different services for different users?

The problem now is that one account has to be shared by two people (technically two devices), and Duo does not support that. We need to enable a different kind of 2FA for that specific user account.

Replacing the 2FA service completely is possible, but it causes some extra time and logistics, contacting the various users and getting them to change over to something else.

I know Google Authenticator works with multiple devices. What app is recommended for Google Authenticator 2FA anyway?

Thanks for your help.

Vikas Nare · Answer

Hello Henning,

I hope all is well on your end.

Yes, you can use the Google Authenticator application which works with multiple devices. You just need to share the Secret key with your users so that they can configure it on their end.

To achieve this you need to use 3rd party apps available on the marketplace. There multiple 2FA plugins available on the Atlassian Marketplace which support 2FA with Google Authenticator for Confluence server.

Here is one of the plugins that support 2FA for Confluence using Google Authentication.
https://marketplace.atlassian.com/apps/1221328/two-factor-authentication-2fa-confluence?hosting=server&tab=overview

The plugin also supports several 2FA methods such as Security Question, OTP Over Email & Backup Code that you can use in the case of an emergency login.

Also, it would be better if you can raise a support ticket to the vendor for faster resolution. They will help you out to configure the plugin.

Again, if you are using the miniOrange, you can raise a ticket from the link given below.

miniOrange Support
https://miniorange.atlassian.net/servicedesk/customer/portal/2

PS: I work for miniOrange one of the top SSO & 2FA/MFA vendors on the Atlassian Marketplace.

Josh Steckler · Answer

Hello Henning,

You may want to take a look at the add-on from Resolution https://marketplace.atlassian.com/apps/1212129/saml-single-sign-on-sso-confluence?hosting=server&tab=overview

It allows for multiple IDPs, and has a way to select which one in certain circumstances. I'm not sure it will completely work the way you want it to, but it's worth a look. There are a few different "selection methods" to send a user to the right idp.