Auth Modules Inquiries & Safe Practices for Configuring Auth in IDE Services Cloud & Standalone License Vault Cloud

Question

What exactly are "Hub" and "Hub Auth Module"? How do authentication modules like Hub and JetBrains Account work within IDE Services Cloud & standalone License Vault Cloud? Should we disable JetBrains Account Auth Module and all the other unnecessary auth modules if we want to enforce only one primary auth module in our organization?

Answer

JetBrains Hub in IDE Services Cloud & Standalone License Vault Cloud

In IDE Services Cloud & Standalone License Vault Cloud, user authentication is managed via JetBrains Hub, a centralized authentication and identity management platform. Each IDE Services instance comes preconfigured with its own JetBrains Hub instance that controls various auth modules for managing user accounts, authentication providers, and single sign-on (SSO) functionalities.

How Do Users Login to IDE Services Cloud & Standalone License Vault Cloud?

• IDE Services Cloud instance URL: https://<ide-services-domain-name>.jetbrains-ide-services.com for user logins.
  • JetBrains Hub URL: https://<ide-services-domain-name>.oauth.jetbrains-ide-services.com is the base URL for your instance's JetBrains Hub (Platform).
• Standalone License Vault Cloud instance URL: https://<license-vault-domain-name>.fls.jetbrains.com
  • JetBrains Hub URL: https://<license-vault-domain-name>.oauth.fls.jetbrains.com is the base URL for your instance's JetBrains Hub (Platform).

JetBrains Hub vs. Hub Authentication Modules

• JetBrains Hub (Platform): Handles auth modules across JetBrains products: Introduction to Hub
• Hub Authentication Module: Built-in credential system, and one of the auth modules inside JetBrains Hub for direct username/password authentication:
  • IDE Services Cloud: Hub auth module is enabled by default in IDE Services Cloud
  • Standalone License Vault Cloud: Hub auth module is disabled by default in License Vault Cloud

JetBrains Account Auth Module

• Enables login via existing JetBrains Accounts. It is the default auth module that works out of the box for both services.
  • IDE Services Cloud: JetBrains Account auth module and its configuration
  • Standalone License Vault Cloud: JetBrains Account auth module and its configuration

If your organization primarily uses other auth modules such as Okta, OpenID, Entra ID or others, there is generally no need to enable Hub Authentication Module unless direct username/password authentication is required internally.

Should You Disable JetBrains Account Plus All the Other Unnecessary Auth Modules and Leave only One Primary Auth Module Enabled?

1. In short, no. It is advisable to keep the JetBrains Account Auth Module enabled but not setting it as default: In this case, JetBrains Account Auth Module will serve as a fallback access method for administrators. It is preconfigured in JetBrains Hub to make it easy for administrators to access the admin settings, as they already have a JetBrains Account from the initial cloud instance setup. This is especially useful when the primary auth module is "broken", such as client secret expiry that causes administrators to lose access to JetBrains Hub (or even worse, all users failed to authenticate to access IDE Services Cloud/License Vault Cloud), preventing them from updating the necessary settings to restore access for all users.
2. Then, enable the primary auth module and set it as default: This ensures all users are authenticated through the main Identity Provider directly without being prompted to choose which auth module to log in (which means the login options page will no longer show up to prevent confusion). This also avoids scenarios where multiple authentication methods might inadvertently create redundant accounts for users.

Stuck in a Login Deadlock? How do I Switch to Login with JetBrains Account Auth Module When Default Auth Module Fails?

1. You can use this link to manually access the login options page when the default Auth Module is broken:https://<ide-services-domain-name>.oauth.jetbrains-ide-services.com/loginOptions (for IDE Services Cloud) / https://<license-vault-domain-name>.oauth.fls.jetbrains.com/loginOptions (for License Vault Cloud). Please note that users will not be forwarded to this page unless adding "/loginOptions" manually. From there, click the JetBrains Account Auth Module logo to proceed with login. Now you should be able to access the JetBrains Hub admin page to update the necessary settings for your main auth module that is broken.
2. You may also review: Resolving Lost Access to JetBrains IDE Services Admin Account for more information.
3. Please also review: [HowTo] configure a backup authentication method for administrator access.