nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

OKTA Jira portal backdoor into Jira via the portal bypasses MFA

Sue Webber_cbksjw

We have OKTA on Jira Server.

The MFA process works correctly. However we have found the following anomaly

Understanding that OKTA does not work on the Jira Service Desk Portal.

Logging into the portal and opening a ticket.

If the user has agent access, clicking on the ticket link in the portal will open up the ticket in Jira backend with no MFA process.

Has anyone encountered this ?

Accepted answers

All comments

Alex Koxaras -Relational-

Hi @Sue Webber

The process you are referring to, meaning clicking on the issue -> navigates to the agent's view, it's the normal behavior.

However I haven't try to login to portal as an agent and then clicking on the ticket to navigate me inside Jira (agent's view) without enforcing the 2FA.

Alex Koxaras -Relational-

And @Sue Webber read this article which might help you https://confluence.atlassian.com/jirakb/bypassing-okta-to-allow-users-to-login-to-jira-locally-1168844223.html

Sue Webber_cbksjw

Hi Alex

So yes it is this scenario "However I haven't try to login to portal as an agent and then clicking on the ticket to navigate me inside Jira (agent's view) without enforcing the 2FA"

No 2FA is requested at this point and the agent view of the ticket is opened.

Opening up an additional tab to Jira backend instance then does not 2FA. You are literally in without 2FA.

Alex Koxaras -Relational-

But the 2FA is imposed from OKTA, right?

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

okta

jira-service-management

jira-service-management-server