All users in my google domain use 2fa on google accounts.

We have on-premise software (gitlab for example) that allows us use google accounts to login.

Also, gitlab has a feature of 2fa.

Should we use it? Does it add something to security or not?

  • Does gitlab's 2FA kick in when you use Google to login? I've never seen that in SSO.
    – schroeder
    Jun 2 at 6:57
  • It asks me about second 2FA Jun 2 at 7:32

2FA is designed to provide security against compromised credentials. Since you are using SSO, the credentials are that of the other IdP (Google, in your case). So 2FA on your Google account protects those credentials.

However, you might decide that SSO is a potential risk and the IdP might get compromised or someone might be able to provide 2FA codes to the 3rd party credentials. In that case, you might consider enabling 2FA on the local service as well (i.e. Gitlab).

Since you are likely storing your "crown jewels" in Gitlab, this is not a crazy thought, but that is up to your risk assessment.

So, yes, it does add security. Whether or not that extra security makes sense for you, or if it will prove to be an annoyance with no benefit, is up to your assessment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.