Bitbucket OTP reset

Question

Hello,

Im an ADMIN in the bitbucket of our company, is there a way for me to reset the OTP of a user if the user is not receiving any OTP on his device

Christos Markoulatos -Relational- · Answer

Hi @klim ,

That points to the Bitbucket-side two-step verification, not the Atlassian account one. They are two separate things:

* Atlassian account 2SV: castle icon, "Can't use your phone?" button. This is what the organization policy and the admin reset control.
* Bitbucket Cloud 2SV: phone/laptop icon, "Forgot code" button. This is set on the user's Bitbucket account itself. The authentication policy, a new device, or deleting and re-inviting the user do not touch it, which is why the screen keeps coming back.

If the screen the user hits has the "Forgot code" button, this is the recovery route, and it can only be done by the user:

* Enter the password, then select "Forgot code".
* Select "Send recovery email".
* A first email arrives saying a one-time login link will follow after 24 hours. The wait is a security measure and cannot be shortened, by you or by Atlassian.
* After 24 hours a second email arrives with the login link, valid for 24 hours. Following it logs the user in with two-step verification disabled.
* The user can then set it up again.

Two things to check: the emails go to the primary email of the Bitbucket account, so look in spam and junk folders too. And Atlassian states it cannot disable two-step verification on a Bitbucket user account, so there is no admin override; if the recovery email never arrives, the user should raise a support ticket with Atlassian.

If the user still has an SSH key registered on a machine, the Bitbucket docs also describe retrieving the recovery codes over SSH, which skips the 24 hour wait.

Sources:

* How to Disable/Reset 2FA on Bitbucket Cloud and Atlassian Account
* Enable two-step verification (Bitbucket Cloud)

klim · Answer

thank you @Christos Markoulatos -Relational- , i have already tried the first step that you have provided.. but it's weird that when the user tries to relogin again, even if i have transferred him to a policy where 2FA is disabled, will still ask for the same thing, also tried logging in to a different device but still the same result, it always ends up in the bitbucket 2FA notification screen, i also tried deleting the user and inviting him again to the organization, but still same effect.. we cant bypass the 2FA Bitbucket screen.

Christos Markoulatos -Relational- · Answer

Hi @klim , It depends on whether you are on Bitbucket Cloud or Bitbucket Data Center, and on Cloud a Bitbucket workspace admin cannot reset it. Which one are you on? Bitbucket Cloud Login goes through the user's Atlassian account, so the reset is done there, not in Bitbucket. * If the account is a managed account of your organization, an organization admin can reset it:* Go to admin.atlassian.com and select your organization. * Select Directory, then Users. * Set the Account type filter to Managed accounts and open the user. * Select the Security tab. * In the Authentication policies table, select more actions (•••), then Reset two-step verification. * If two-step verification is enforced by an authentication policy, first move the user to a policy where it is optional, reset, let them log in and set it up again, then move them back. * If the account is not managed by your organization, no admin can reset it. The user recovers it themselves:* On the login screen, after email and password, select "Can't use your phone?". * Enter the emergency recovery key. * If the key is lost, select "Can't find your recovery key" and request a recovery email. A login link arrives after a 24 hour wait. If the user gets codes from an authenticator app and they are rejected, also check that the clock on the phone is correct. Bitbucket Data Center (built-in two-step verification) The second step is a code from an authenticator app, so nothing is sent to the device. The user can log in with the recovery key from setup. If that is lost too, a system admin can unenroll the user over REST: DELETE /rest/tsv/latest/totp/unenroll/user/{username} Body: { "totpCode": "" } The system admin must have two-step verification set up themselves, and the call needs a valid admin session cookie. A 204 response means the user was unenrolled and can enroll again. If your OTP comes from a third-party 2FA app instead, the reset is in that app's admin settings. * Make changes to a managed account * Enforce two-step verification * Login issues related to two-step verification * How to Disable/Reset 2FA on Bitbucket Cloud and Atlassian Account * Enable two-step verification (Bitbucket Cloud) * Manage two-step verification for your Atlassian account (Data Center)