nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Enabling Multifactor Authentication - Bitbucket Cloud

Dspiliopoulos

Good morning,

Seeing SSO is still not supported when using Bitbucket explicitly in the cloud, we were looking at enabling multi-factor authentication on our Bitbucket instance with the use of SSH Key pairing.

Could somebody confirm that this can be achieved user by user as opposed to forcing MFA for every user? The goal is to minimize impact and transition to MFA gradually.

Thanks

Accepted answers

All comments

Ana Retamal

Hi Dimitrios! This has to be done per user, it's not possible to do it in bulk or even enforce it. For more information on how to enable it, you can read Two step verification. However, keep in mind that if you request higher security for some of your content, every user will need to have it enabled in order to access it, as you can see at Control access to your private content.

Let us know if you have any questions!

Ana

Dspiliopoulos

Hi Ana,

Firstly thank you very much for your reply. I will proceed accordingly as you mentioned. One more thing which comes to mind is the SSH_Key pair which is a prerequisite to enabling MFA.

Seeing our Bitbucket subscription is composed of mostly internal company users and a few contractors, do I have the option of creating a single set of SSH key pairs to provide to each user?

The reason for this is for better manageability if that makes sense.

Also, once MFA is enabled is my understanding correct that only https for applications using that protocol will be disabled? Ill still be able to log into our Bitbucket Cloud login correct to merge and approve pull requests?

Thanks

Dspiliopoulos

Hi Ana,

There is one important aspect I am missing when enabling multi-factor authentication. When it is stated that https will be disabled, does that only refer to the type of access on repo functions like cloning, pushing, pulling etc. within a project or does that disable https access to the bitbucket console too?

What is confusing, is that if only https access to the repo itself is disabled, how does that improve security, when a DEV can then access our Bitbucket account console through https and have access to the repos from there?

Ana Retamal

Hi Dimitrios

do I have the option of creating a single set of SSH key pairs to provide to each user?

That won't be possible as once an SSH key is entered in Bitbucket, it will give an error if someone else tries to use the same. Every user needs a different SSH key.

Also, once MFA is enabled is my understanding correct that only https for applications using that protocol will be disabled? Ill still be able to log into our Bitbucket Cloud login correct to merge and approve pull requests?

I'm not sure I quite understand this question. You'll still be able to login to your account normally and perform all the operations you were able to do before, the only difference is that logging in will require an extra step for the added security. Is that what you were asking?

Regarding your latest question:

What is confusing, is that if only https access to the repo itself is disabled, how does that improve security, when a DEV can then access our Bitbucket account console through https and have access to the repos from there?

The Dev will have the same access from the web interface than from the console, he will need to be authenticated too. I'm not sure what you're referring too when you say 'disable https access', afaik that feature is only available in Bitbucket Server. Could you please clarify on this?

Best regards

Ana

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

bitbucket

authentication

2-factor-authentication