Problem setting up required Two-Step authentication

[james.mckean]

As a tentative step toward moving from BB Data Center to BB Cloud, I am setting up a bucket.org POC. It is built on a Premium account.

I have set up my SSH key and turned on  Required Two-step Authentication.  It works on my account.

Then, because I need to prepare some "how to" documentation for the other users on my POC, I created a new email account, added then to a Developer group and sent the invitation.  I opened a second browser and saw that the invitation arrived as expected.  I clicked on the link and then everything gets a bit weird.

I was taken to an Atlassian account setup process and when complete, I was dropped into a personal BB cloud account - not the workspace I had issued the invitation from.

So I logged out and clicked on the invitation link again.  This time I was dropped into the right workspace -- but there was no second step authentication and no prompting to set it up. I have been in and out of the test account a half dozen times and have never been prompted for second factor.  I have also not been shown the authenticator QR code or asked to set up SSH keys.

It looks like it is working like non-premium account.  I can sign up to have 2 factor, but if I don't, I can get in and browse the contents just fine.  I don't have enough content yet to try out git, but this is not working as I expected.  Can anyone explain?

[james.mckean]

OK, I see where I went wrong.

First, I forgot to set the workspace and associated projects and repos as "private" so they were world readable.  My miss.

Once I did that, my test user could not see anything in the workspace. This is where I made my second mistake.  I was expecting BB to prompt a new user to set up 2FA if they

1. are in a user group of the workspace and 
2. are trying to get to that workspace

Not true.  A user must self-elect to turn on 2-step authentication for their own account, then they are led through the process of setting up an SSH key and configuring the 2 step. Then they can see the assets in the workspace.

Hope this helps someone.