Skip navigation

Duo for Jira 6 and 7 - Legacy Plugin

Last Updated: March 10th, 2021

Duo integrates with the on-premises Atlassian JIRA Software project and issue tracking application to add two-factor authentication to your logins, complete with inline self-service enrollment and Duo Prompt. The code is open-source and available on GitHub.


These Duo for JIRA instructions support JIRA 6.1 and 7. Only on-premises installations of JIRA Software are supported. Mobile browsers may experience issues logging on with two-factor and are not currently supported.

Check your JIRA version before installing Duo. Also note the location of your JIRA installation directory.

Note that installing Duo may cause issues with application links between JIRA and Confluence. Read this for more information.

First Steps

  1. Sign up for a Duo account.
  2. Log in to the Duo Admin Panel and navigate to Applications.
  3. Click Protect an Application and locate the entry for Jira with a protection type of "2FA" in the applications list. Click Protect to the far-right to configure the application and get your integration key, secret key, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications in Duo and additional application options.
  4. Download the latest duo_jira release package as a zip file from GitHub and uncompress the package on your JIRA server.

Treat your secret key like a password

The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!

Duo Universal Prompt

Duo's next-generation authentication experience, the Universal Prompt, is coming to web-based applications that display the current Duo Prompt in browsers.

Migration to Universal Prompt for your Jira application is a two-step process:

  • Update the Jira application to support the Universal Prompt.
  • Enable the Universal Prompt experience for users of that Jira application (when the Universal Prompt becomes available).

Jira needs a software update installed to support the Universal Prompt when it's ready. The "Universal Prompt" section reflects this status as "App Update Ready" today. If you're configuring Duo for Jira for the first time now, we recommend installing the Universal Prompt for Jira instead. If you want to update your current Jira Duo application to a newer version, follow the update directions for the Universal Prompt.

Universal Prompt Info - Update Available

Once a user authenticates to Jira via the updated Duo plugin, the "Universal Prompt" section of the Jira application page reflects this status as "Waiting on Duo".

Universal Prompt Info - Application Updated

When the Universal Prompt becomes available, you'll return here to activate it for users of this application. The status will change to "New Prompt Ready", and you'll see the control here for turning it on or off. Until then, your users continue to experience the current Duo prompt. Your users will also continue to see the current Duo Prompt if you haven't updated your Duo application software.

Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications in-scope for Universal Prompt support.

Read the Universal Prompt Update Guide for more information about the update process to support the new prompt, and watch the Duo Blog for future updates about the Duo Universal Prompt.

Universal Prompt Private Preview

If you've updated your eligible application so that its update status shows "New Prompt Ready" and you're interested in participating in a private preview of the Universal Prompt experience, please apply using this form.

Install Duo Using a Script

After running the install script you will edit a configuration file, install an add-on with the JIRA UI, and restart JIRA to complete the setup.

From the command line, run the installer from within the duosecurity-duo_jira directory with the following arguments:

$ ./ -i <your_ikey> -s <your_skey> -h <your_host> -d <jira_location>
Required Arguments
-i Your integration key (i.e. DIXXXXXXXXXXXXXXXXXX)
-s Your secret key
-h Your API hostname (i.e.
Optional Arguments
-d The directory where JIRA is installed. Defaults to /opt/atlassian/jira if not specified.

The script copies Duo JAR files into yourJIRA install directory. If the script is unable to copy the necessary Duo files, try installing Duo manually.

After running the install script, follow the instructions to install the add-on and edit your configuration.

Install Duo Manually

To install the Duo plugin for JIRA manually, first find the top directory of your JIRA installation, called $JIRA_DIR below. This is usually /opt/atlassian/jira.

If you've already installed Duo using the install script you don't need to do these manual install steps. Skip to Configure JIRA.

  1. Install the duo web JAR

    Copy the prebuilt DuoWeb-1.3.jar from the unzipped etc directory into the JIRA lib directory.

    cp etc/DuoWeb-1.3.jar $JIRA_DIR/atlassian-jira/WEB-INF/lib
  2. Install the duo client JAR

    Copy the prebuilt duo-client-0.2.1.jar from the unzipped etc directory into the JIRA lib directory.

    cp etc/duo-client-0.2.1.jar $JIRA_DIR/atlassian-jira/WEB-INF/lib
  3. Install the Seraph Filter

    Copy the prebuilt duo-filter-1.4.3.jar from etc into the JIRA lib directory.

    cp etc/duo-filter-1.4.3.jar $JIRA_DIR/atlassian-jira/WEB-INF/lib

After manually copying the JAR files, follow the instructions to install the add-on and edit your configuration.

Install the Add-on and Configure JIRA

  1. Install the Plugin

    The plugin provides the UI to send credentials to Duo and post results back.

    From the JIRA administration console, select Add-ons from the left navigation, then Manage add-ons. Click Upload Add-on and browse to the unzipped etc/duo-twofactor-1.4.3.jar file. Click the Upload button.

  2. Configure JIRA by editing web.xml, located at $JIRA_DIR/atlassian-jira/WEB-INF/web.xml.

    You will add a filter, which can intercept web requests, and a filter mapping, which causes all requests to go through the filter.

    The Duo filter must be added immediately after the local authentication filter, which has a filter-name of security, and before any subsequent filters.

    Use the appropriate values for ikey, skey, akey, and host, as described in Install Duo Using a Script.

    Your akey is a string that you should generate and keep secret from Duo. It should be at least 40 characters long. You can generate a random string in Python with:

    import os, hashlib
    print hashlib.sha1(os.urandom(32)).hexdigest()

    This is the security filter already present in the web.xml file.


    Paste the below duoauth filter section immediately after the security filter section in web.xml, using your ikey, skey, akey, and API host values:

    <!-- the duoauth filter and mapping to add, with appropriate param-value entries -->
        <!-- set fail.Open to true to fail open or false to fail secure -->

    This is the security filter-mapping already present in the web.xml file.

        <dispatcher>FORWARD</dispatcher> <!-- we want security to be applied after urlrewrites, for example -->

    Paste the below duoauth filter-mapping section immediately after the security filter-mapping section in web.xml.

  3. Restart JIRA.

    • Linux: Run the command sudo /etc/init.d/jira stop ; sudo /etc/init.d/jira start
    • Windows: Open the "Services" console (services.msc). Locate the Atlassian JIRA service and restart it.

    If you haven't configured JIRA to start with a script or service see the JIRA documentation.

Test your Setup

To test your setup, log into JIRA. Duo's enrollment or login prompt should appear after you enter your username and password.

Enable Hostname Whitelisting

If you plan to permit use of WebAuthn authentication methods (security keys, U2F tokens, or Touch ID), Duo recommends enabling hostname whitelisting for this application and any others that show the inline Duo Prompt before onboarding your end-users.

Updating the Duo Plugin

Please see the instructions for updating the v1.x Jira plugin to the Duo Atlassian 2.x plugin, featuring support for the Duo Universal Prompt.


To deactivate the filter, remove or comment out the filter mapping from web.xml and restart JIRA. Duo authentication is no longer required.


Need some help? Take a look at the JIRA Frequently Asked Questions (FAQ) page or try searching our JIRA Knowledge Base articles or Community discussions. For further assistance, contact Support.

Network Diagram

  1. Jira connection initiated
  2. Primary authentication
  3. Jira connection established to Duo Security over TCP port 443
  4. Secondary authentication via Duo Security’s service
  5. Jira receives authentication response
  6. Jira session logged in

Appendix: Building Manually

JARs and templates are located in the etc directory. If you'd prefer to build your own JARs, here is how to do it. The plugin JAR must be rebuilt if you want to customize the Duo authentication page.

  1. Build the duo web JAR

    If you'd prefer to build your own DuoWeb-1.3.jar, the latest duo_java release source is available from Github. It can be built with the Atlassian plugin SDK. In a temporary directory:

    git clone git://
    cd duo_java/DuoWeb
    atlas-mvn install

    After this step, the built JAR can be copied to the JIRA lib directory as described in Install the duo web JAR.

  2. Build the duo client JAR If you'd prefer to build your own duo-client-0.2.1.jar, the duo_client_java source is available from Github. It can be build with the Atlassian plugin SDK. In a temporary directory:

    git clone git://
    cd duo_client
    atlas-mvn install

    After this step, the built JAR can be copied to the JIRA lib directory as described in Install the duo_client_java JAR

  3. Build the Plugin JAR

    Optionally Customize the Duo Authentication Page

    The authentication page template is duo_twofactor/src/main/resources/duologin.vm. It can be used as-is, or styled to match your organization.

    If you want the Duo authentication page to include other resources, such as scripts or images, put them in the resources directory as well, and edit atlassian-plugin.xml to add them to the served resources. After customizing, rebuild and install the JAR.

    Build the JAR

    If you'd prefer to build your own duo-twofactor-1.4.3.jar, it can be built with the Atlassian plugin SDK from the latest duo_jira release source from GitHub:

    cd duo_twofactor
    atlas-mvn package

    After this step, the built JAR can be installed as described in Install the plugin.

  4. Build the Seraph Filter JAR

    If you'd prefer to build your own duo-filter-1.4.3.jar, it can be built with the Atlassian plugin SDK from the latest duo_jira release source from GitHub:

    The seraph filter has duo_java and duo_client_java as build dependencies. Please follow the instructions for manually building duo_java and duo_client_java before attempting a manual build of the seraph filter.

    cd duo_seraph_filter
    atlas-mvn package

    After this step, the built JAR can be installed as described in Install the Seraph filter.