Lastpass -out of band-

Hello,

Duo should be supported in Lastpass, we'll do tests on our side to see what's going on.

As a workaround, could you try going in File > Options > Types > Credentials, and under the LastPass category, check the box for "use legacy connection mode (mobile)". This might let you use google authenticator instead of Duo. The reason this option exists is that depending on what device LastPass detects that you're on (desktop or mobile), it will prompt a different configured 2FA.

Regards,

Hello,

Just to let you know, we tested Duo authentication internally and it works well for us. Is there any other security settings that you have configured on your account that could be required when authenticating? Other 2FA methods that are configured perhaps?

Regards,

Hi Hubert
We only have DUO and Goolge Authenticator active. It works without problems if the account has 2FA disabled, but with 2FA it shows the message, that it will send a 2Factor, but nothing happens after that and it just gives the error message.

Is there a log where we could check what going on?

The DUO User has more than one mobile phones, so normally when we use DUO i shows a dialog, and asks on which device the DUO push should be sent. Did you implement this in RDM as well? Or could you test it, how it behaves if you have more than one devices in your account? Will it just takes the first one? (so perhas a push went out, but to the wrong device)

In Lastpass this Option needs to be active in the account options of Lastss unter DUO, so it will ask which device, if we login to lastpass in a webbrowser.



Best regards.
Patrick

Thanks for the details on your setup, we only tested with one device. We'll change our setup to test like you were and see if we also reproduce. It's very possible that it always sends to the first device as you said.

Regards,

Great, thanks a lot. Here are some more information about the interactive mode, Lastpass supports for DUO. Would be great to see this working in RDM as well: https://duo.com/docs/lastpass

To update you, we were able to reproduce what we think is the issue when having more than one device configured. Your assumption was right, RDM always chooses the first device and sends a push notification to it. So if you don't have access to that device, that would explain the error (it must be timing out).

I've opened a ticket so we can take a look at this issue.

Regards,

Hi Hubert

Would you have any news here?

Also an additional question, we need to move some credentials in Lastpass to a new folder. Is there an easy way to find all places where this password-card was used and replace it with the cards new location?

Best regards.
Patrick

Hello,

Sorry about the delay. We're currently working on a solution for the issue with Duo on multiple devices. It's not simple due to how Lastpass handles Duo, but we're making a lot of progress.

For your other question, I believe RDM looks for the credentials' ID, and not its name/location, so it shouldn't affect the entries that are already saved. Could you do a test with just one entry to confirm?

Regards,