0

All users in my google domain use 2fa on google accounts.

We have on-premise software (gitlab for example) that allows us use google accounts to login.

Also, gitlab has a feature of 2fa.

Should we use it? Does it add something to security or not?

2
  • Does gitlab's 2FA kick in when you use Google to login? I've never seen that in SSO.
    – schroeder
    Jun 2, 2021 at 6:57
  • It asks me about second 2FA Jun 2, 2021 at 7:32

1 Answer 1

1

2FA is designed to provide security against compromised credentials. Since you are using SSO, the credentials are that of the other IdP (Google, in your case). So 2FA on your Google account protects those credentials.

However, you might decide that SSO is a potential risk and the IdP might get compromised or someone might be able to provide 2FA codes to the 3rd party credentials. In that case, you might consider enabling 2FA on the local service as well (i.e. Gitlab).

Since you are likely storing your "crown jewels" in Gitlab, this is not a crazy thought, but that is up to your risk assessment.

So, yes, it does add security. Whether or not that extra security makes sense for you, or if it will prove to be an annoyance with no benefit, is up to your assessment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .