Is it possible to log in to jira using only one link

Question

Our company wants to set up SSO for Jira and other systems, and wants to log in to jira with only one link (the link contains cipher text account password or token), and would like to ask how it can be achieved

I found this access method on the Internet: https://jira.xxxxx.cn/?os_authType=basic&os_username==&os_password=
However, the user name and password are in plain text, so it is dangerous to decide not to use

I have considered writing a plug-in to complete this requirement, but stuck in this last step, because the last return to another server is a link, click to log in

jira version is 8.4.1, deployed on our own server

Ed Letifov _TechTime - New Zealand_ · Answer

Please look at any of SSO apps available on Marketplace.

The original idea of "a link with something replacing the password" is a security nightmare on itself. What if someone steals your link?

Besides, consider all possible way Jira exposes links to itself e.g. emails. For your solution to work, every possible link will have to be enhanced with such tokens.

Any tokens used for authentication must be generated on the fly, be short-lived, and be based on your credentials. Anything homegrown will require you to enter your credentials to generate the very link – so you end up with the same password-based login. What's the point?

Our app already mentioned above is EasySSO for Jira – we offer 5 different authenticators NTLMv2, Kerberos, SAML, X.509 and HTTP Headers to give you and your Solution Architects more choice in SSO space.

In particular, if you are running a Windows Domain, then with NTLMv2/Kerberos you will achieve exactly what you are after but without any tokens exposed – the user clicks on a regular link (i.e. in the email) and is logged in automaGically though the power of Integrated Windows Authentication, all using industry-standard protocols supported by all major browsers. To be clear, it still does use ciphered tokens, but these are composed and send by the browser automatically as headers with the request.

Lars Olav Velle _Polar SSO_ · Answer

Hi @shadow.fang

Polar SSO is a brand new single sign-on app from our company that in addition to traditional SAML and Kerberos, also offers two factor authentication and password-less login using e.g. face and fingerprint, apple watch etc)

It also offers the most simple setup of all your choices out there.

Cheers,

Lars

Andrew Laden · Answer

EasySSO is another add on that can help with Single sign on options.