Auth Modules

Available Actions

The following actions are available on the Auth Modules page:

Hub Authentication

User authentication and authorization in YouTrack are managed by Hub. When you first install YouTrack, the Hub authentication module is already preconfigured and active. This authentication module is used to verify the identity of the system administrator who provided credentials for the default administrator account during installation.

If you don't want to configure single sign-on using accounts from a third-party authentication service, you can just use the Hub authentication module.

• With user registration enabled for the Hub authentication module, all you have to do is send your users a link to the Hub installation. Anyone with access to the site will be able to create their own account.

• When registration is disabled, an administrator must create accounts for each user or send invitations to register using email.

The Hub authentication module is built to support additional features, including account restoration, password strength requirements, and CAPTCHA challenges. The availability of these features in third-party authentication providers varies from service to service. To learn more, see Hub Auth Module.

Third-party Authentication Providers

In addition to the built-in authentication service provided out of the box, YouTrack lets you connect to one or more third-party authentication services.

One of the advantages of third-party authentication is that it leverages accounts for services that may already be in use by your organization. By allowing users to sign in with a single set of credentials across multiple applications, they are less likely to experience the frustration that comes with remembering multiple usernames and passwords.

YouTrack provides pre-configured authentication modules for services that work with various protocols like OAuth 2.0, SAML, LDAP, and OpenID. It also provides generic modules for each protocol that you can use to let users log in to YouTrack with accounts from other third-party services. To learn how to set up an authentication module for a specific service provider, select a topic from this section in the documentation.

Default Authentication

Hub lets you designate a specific authentication module as the system default. When used, unauthenticated users who open a URL that belongs to YouTrack are automatically redirected to the default authentication provider, skipping the standard YouTrack login page. Once authenticated, users are redirected to the originally requested page.

Users who are already authenticated in the default authentication service can navigate directly to the target page.

In situations where there are problems with the default authentication service, users are redirected to an error page. This page contains a link that lets users try using another login option to access YouTrack. When clicked, users are directed to the YouTrack login page. Here, they can select any available authentication providers to log in.

Use this feature when you want users to log in with accounts from a specific identity provider while still providing secondary login options when there's an outage or another connection problem.

If none of the available authentication modules are designated as the default, unauthenticated users are always directed to the YouTrack login page. The same is true when the built-in Hub authentication module is set as the default.

Two-factor Authentication

Two-factor authentication (2FA) is a security mechanism that enhances the protection of user accounts by requiring two distinct forms of verification before granting access. Users can set up 2FA for their own accounts at any time. This requires that they verify their identity using a second factor when they log in with their Hub account credentials.

If you're working with the Hub authentication module and want to require 2FA, you can configure this requirement at the group level. For example, if you want to require that everyone in your organization adds 2FA to their Hub account, you can configure this requirement for the All Users group. To learn more about this feature, see Require Two-factor Authentication.

If you're working with authentication modules supported by third-party services, the configuration and enrolment in two-factor authentication is also managed in the external service, not YouTrack.

Troubleshooting

The /logs/hub-export.log file contains a log of events related to user-management upgrades. Check this file to detect problems related to users who were not imported or are unable to log in using credentials from a third-party service.