Installation

Installation via the integrated marketplace

Accessing Universal Plugin Manager at...

 Enter Secure Login in the search field and click on the magnifying glass. Secure Login now appears in the search results.

 Click Free trial to get a trial license or Buy now to purchase a license for Secure Login. You will be asked to log in to MyAtlassian while the Secure Login download begins. Enter your credentials and click Generate License when you are redirected to MyAtlassian. Finally, click Apply license.

Manual installation

You can also download Secure Login directly from the Atlassian Marketplace and upload it as a jar file using the Universal Plugin Manager. The documentation of the Universal Plugin Manager describes how it works. You will also find much more information about installing plugins there. If you have more questions about licensing plugins, visit the Atlassian licensing documentation. Here you will also find much more general information about plugins for Atlassian products.

If you have any problems installing Secure Login, please do not hesitate to contact us via our Service Desk. We will find a solution to your problem.

Navigation

Accessing Secure Login navigation at...

Configuration

Before you can use Secure Login, the plugin must be installed and enabled in the Universal Plugin Manager. Also, Secure Login functionality must be enabled in its configuration. Secure Login will perform the pin validation as soon as it has been activated in its configuration. In addition to the activation, you have a variety of ways to customize Secure Login to your needs. These are explained below.

Activate PIN validation (mandatory)

Bamboo & Bitbucket bis Version 2.6.2.0	Jira & Confluence & Bitbucket ab Version 2.8.2.0

 Mark the checkbox Secure Login active at the end of the configuration page.

 Click on Save to activate the pin validation of Secure Login.

Additional settings

TOTP Settings

Context Whitelist

Application Links

Filter Settings

Audit Log Configuration

Brute Force Protection (available, if audit log is active)

Permissions for Administrators

Token Mode

WebAuthn/FIDO2

Audit Log

All relevant actions of Secure Login are logged. This audit log is accessible for administrators only: you can easily find out which user has registered or logged in and when. You can also use various filters to find precisely the entry in the log you are looking for. You can also export the entire log.

 Configure the filter according to your preferences and click Filter to get the result. It is possible to combine different filters. To reset the filter, click Reset.

 If you want to export the entire audit log, click . A CSV file is stored on your computer.

Filter configuration

User Manager and Support of Hardware-Token

The User Manager displays which users are already using Secure Login. Additionally, you can create a Secure Login Profile, if an user should use a hardware token or you can reset a user's tokens, if he or she is no longer able to log in (e.g., the user has changed the authenticator/smartphone without performing a new pairing or has lost it).

 Click Revoke Secret Key to reset a user's token. The user will then disappear from the User Manager, if the user has no valid device, too.

 Click Revoke device to reset a user's WebAuthN/FIDO2 device. The user will then disappear from the User Manager, if the user has no secret key, too.

 Click Register user to create a Secure Login Profile for a user. A profile, which is created by an administrator cannot be revoked by the user. If your organization uses hardware tokens instead of smartphones for 2-factor authentication, the user registration allows you to input the predefined secret keys of the hardware tokens or generate secret keys for configurable hardware tokens.

 Select the user, who will be the owner of the new Secure Login Profile.

 Enter the secret key specified by the hardware token in the Base32 secret key field or generate a secret key by clicking. A new secret key is generated and appears in the Base32 secret key field. You can store this secret key on a configurable hardware token to pair it with Secure Login.

 After pairing the hardware token, it generates pins for 2-factor authentication. Input the current valid pin into the Current PIN field to finish the process.

 Click Create User to save the new Secure Login Profile.

Reset an administrator's account

If you have excluded yourself, for example you have changed the authenticator or smartphone without performing a new pairing, you have two options for re-accessing as admin:

1. Team solution: Another administrator has to log in and reset the Secure Login Token for the affected colleague. Then, the pairing can be performed again.
2. Technical solution: It is possible to reset a Secure Login token directly by accessing the database. The following instructions explain how to do this, but we do not recommend it.
   • Connect to your database using the database management tool of your choice.
     1. The affected user has only a PIN

        1. Identify the SECURE_LOGIN_USER table in your database. This table is named AO_xxxxxx_SECURE_LOGIN_USER while xxxxxx is a 6 digit hash value. (e.g. AO_1D83D9_SECURE_LOGIN_USER)

        2. Get the account row by looking at the column USER_IDENTIFIER. This column contains the user keys of the users.

        3. To reset the account, delete the corresponding data set from the SECURE_LOGIN_USER table. e.g.:

           DELETE FROM AO_1D83D9_SECURE_LOGIN_USER WHERE USER_IDENTIFIER = 'j.doe';

     2. The affected user has a device or a device and PIN

        1. Identify the SECURE_LOGIN_USER and SECURE_LOGIN_DEVICE table in your database. This table is named AO_xxxxxx_SECURE_LOGIN_USER and AO_xxxxxx_SECURE_LOGIN_DEVICE while xxxxxx is a 6 digit hash value. (e.g. AO_1D83D9_SECURE_LOGIN_USER, AO_1D83D9_SECURE_LOGIN_DEVICE)
        2. Get the account row by looking at the column USER_IDENTIFIER in both tables. This column contains the user keys of the users. 

        3. To reset the account, delete the corresponding data set from the SECURE_LOGIN_DEVICE table. e.g.:

           DELETE FROM AO_1D83D9_SECURE_LOGIN_DEVICE WHERE USER_IDENTIFIER = 'j.doe';

        4. Also delete the corresponding data set from the SECURE_LOGIN_USER table. e.g.:

           DELETE FROM AO_1D83D9_SECURE_LOGIN_USER WHERE USER_IDENTIFIER = 'j.doe';

   • If this has been successful, the affected user will be prompted for a new pairing at the next login.

Data security and privacy

Secure Login stores personal data in the database on various events. The following section explains where and for which purpose this data are stored. It also explains how the data can be irretrievably deleted if necessary.

User configurations

Performing an onboarding process, Secure Login generates a secret key for the user, required to generate the PINs for the two-factor authentication (2FA). This key is stored within the database table AO_xxxxxx_SECURE_LOGIN_USER together with the user identifier, creation time, a server label and a validation flag.

The Secure Login user profile allows users to revoke their secret keys on their own as a self-service mechanism. The necessary procedure is described in the section Revoke Token of the User's Guide. In case of revocation, the corresponding database entry will be completely and irretrievably deleted.
The same applies if a secret key is revoked by an administrator within the Secure Login User Manager. For more information, see User Manager.

If a user with a Secure Login user profile is deleted, the user profile will be automatically purged within eight hours by a scheduled job. The process is logged in the application log.

Audit log

Secure Login creates a log entry within the audit log for every successful or failed onboarding or login attempt. These audit log entries are stored within the database table AO_xxxxxx_AUDIT_LOG_ENTRY. In the plugin configuration, you can define how long the audit log should be stored. All entries that are older than the defined period are automatically purged at regular intervals. The process is logged in the application log. More detailed information can be found in the section Configuration.

Application log

Secure Login records various entries to the application log depending on the configured log level and use case. The following describes in which log level Secure Login writes which user-related data to the application log:

Need more help?

If you have any further questions, problems or suggestions for improvement, please feel free to visit our Service Desk or contact us directly. We look forward to helping you.

Write a review for Secure Login

We would also appreciate it if you would write a review for Secure Login in the Atlassian Marketplace. Just select the application for which you have installed Secure Login below. The appropriate review page from Atlassian Marketplace will open. Select Write a review in the top right corner of the content area and enter your review. Thank you very much!

Visit review page of Secure Login for