These settings applies apply to both SAML, OpenID Connect, and Windows Integrated Authentication (Kerberos) , and are found under the “Common” menu.
...
Kantega Single Sign-on does not prevent the usage of traditional username/password login by default. Any user can cancel SSO and log in manually, provided they are provisioned in a way that gives them passwords in the first place. This can sometimes be undesirable, for example, when users are provisioned through AD/LDAP where passwords are available - but the organization wishes to require the use of 2FA or SmartCard.
...
To disable traditional username/password login, go into the Kantega SSO configuration page. Under Common > Disable traditional login, you find a toggle box to enforce SSO.
...
If traditional login is disabled, you will no longer let you log in to an administrator account with using username and password. Even so, retaining an admin account and password in the Internal directory is highly recommended as a backup in case you need to restore SSO functionality. If necessary, you may re-enable password login by deleting the following file on your Atlassian product server:
|
It takes up to one minute for change to have take effect if you disable it by removing the file , and on other cluster nodes if applicable.
Please note that only the standard login forms are disabled, not the core password/directory system. As such, username Username and password login may still be usable through third-party plugins/applications etc. if these they run their own password validation.
...
Kantega Single Sign-on will, by default, only authenticate users where your Atlassian product would otherwise require them to log in with a username and password.
By activating Forced SSO URLs, users may be logged in also on pages that normally do not require this.
You find a form for specifying forced SSO urls URLs under Common > Forced SSO URLs.
...