Secret Server MFA

Hello Jan,

We do not yet support SAML (Azure AD) authentication with Secret Server, it is on our roadmap, but we do not yet have an ETA.

Best regards,

Hi Richard,

thanks for the quick info. Would be really nice to have it implemented asap. Waiting for the version :)

THanks

Jan

Hi Richard,

Any change you can provide an update/ETA?

We are planning to implement Secret Server in Q3 2022 and without this functionality we will stop using RDM and use native Secret Server functionality using the Connection Manager. Since RDM offers many other features I would like to continue using it. This is not possible without RDM integration with Secret Server SAML authentication to Azure AD/MFA.

Hello,

There is still no ETA for implementing SAML (Azure AD) with Secret Server, unfortunately. We had issues for a long time contacting Thycotic, but the situation is better since they merged as Delinea.

It is an often-requested feature, so it is high priority.

Best regards,

Hi Richard,

Is there anywhere we can follow the development on this topic?

Looking forward to hearing from you

Best regards,

Mark Johansen

Hello Mark,

We were recently granted access to an instance with SAML by Delinea, so our team can start working on the integration. Our plan is to have the feature available in the 2022.3 release of RDM, in Q4 of this year.

Best regards,

Hello Richard,

That is wonderful news - is it possible to sign up for beta on this branch as it's a vital service for my company and is very interested in facilitating test of this.

Best regards

Mark Johansen

Hello Mark,

The beta should be available in October, you can subscribe for notifications on this forum for the announcement: https://forum.devolutions.net/forums/14/remote-desktop-manager--beta

Best regards,

Hello Mark,

The beta should be available in October, you can subscribe for notifications on this forum for the announcement: https://forum.devolutions.net/forums/14/remote-desktop-manager--beta

Best regards,

Hi, is the Azure AD MFA integration with SecretServer available on latest RDM 2022.3.24.0 64-bit?

Hello Luca,

There were some issues with our SAML integration with Secret Server, but there has been progress in the past few weeks. The official target date is the 2023.1 release of RDM, but if it is available before, it will be added in a minor version of RDM 2022.3.

Best regards,

Hi Richard,

is there any update on this? when will this be released?

BR

Srikanth

Hello Srikanth,

After verifying with Delina, the REST API of Secret Server does not support SAML authentication. Once Delinea adds it on their end, we will be able to integrate it to RDM.

Best regards,

Hi,

so this is not going to be available on 2023.1 as per your message above?

BR

Srikanth

Hello,

Unless Delinea adds support to SAML by then, it will unfortunately not be possible.

Best regards,

Hello Srikanth, hello Richard,

We face the same problem, as our Secret Server instance is using a corporate SAML MFA solution, making the simple login with in RDM not usable.

Our integration solution is to use a web password credential entry (like Chrome passwords or 1Password), so RDM opens a web site, then let Delinea's Web Password Filler plugin fill in the credentials.

Of course we also would welcome a more streamlined solution, but I think a custom corporate card/app has small chance of getting integrated.

However, I'd like to raise attention to the API token feature in Secret Server. Once a user is logged into the Secret Server (by any method, by any browser), he/she can copy out an API token, allowing scripts to use this authenticated session live (so no reauthentication necessary).

This is located on the user preferences page, as "Generate API Token and Copy to Clipboard".

Maybe asking this key and having a map of credentials<->Secret IDs might be an integration possibility.

What do you think, Richard, can this be a solution?

Best regards,

Zsombor Aklan

Hello Zsombor,

I will send the information to the engineering team to see if it could be an option, but since it requires manual intervention every time the token expires, it is not the best experience.

Best regards,

Hello Zsombor,

I verified with the engineer in charge of the integration, and he was given the option to use the Delinea WPF to retrieve the token and bring it back to RDM. The engineer will verify if it is possible to parse the webpage to retrieve the token automatically, which would simplify the process and be the best workaround. He cannot commit to an ETA at this time, however.

Delinea told us the native SAML integration will be addressed in the future, so hopefully it will be possible soon.

Best regards,

Hello Richard,

This is great news! Thank you for the quick reply! Please feel free - you or the engineering team - to contact me directly if you need a live demo or some more details from our Secret Server integration; I will be happy to assist!

Best regards,

Aklan Zsombor

Hi, do you have any news? Did Delinea give any ETA about SAML implementation in REST API?

Hello Luca,

My last info is from Richard, the same what you can see above. Since then Delinea has released Web Password Filler v3.4.2, with a lot of fixes. Maybe this gives Delinea some more chances. I am also awaiting news.

@Richard, is there some updates? I still uphold my offer to show our integration method (but most probably it is already known to the dev team) :) Anyway, let me know if I can contribute.

Best regards,

Zsombor

Hello,

Luca - We did not receive any update from Delinea, unfortunately.

Zsombor - The engineering team was provided that workaround from Delinea as well, it is still on the to do list of the engineer in charge of the integration to try to automate it and see if it is viable. Thank you again for your offer.

Best regards,

Hi , are there any news on this toppic ?

we facing the same issue

Regards Robert

Hello Robert,

The engineering task is still in the backlog, unfortunately. We will let you know once we have more details.

Best regards,

Hi Richard,

Any news about this topic?

We need to add MFA to Secretserver portal login, and at the moment only Connection Manager is able to connect to the server if MFA is enabled.

We have several RDM licenses ending at the end of the year, RDM is a great tool, we don't want to migrate to Connection Manager.... But we will be forced to do that if we will not be able to grab credential from Secretserver to connect to several server.

L.

Hello,

Unfortunately, there is no update on the integration of SAML to Delinea / Secret Server. Their API still does not support it, so we are working on a workaround method.

Best regards,

Hello

We're introducing Secret Server now to our company and depending on this feature we have to decide if we're authenticating to Secret Server via SAML or AD. Can you tell me in what state the workaround is or already provide an ETA?

Best Regards

Philipp

Hello Philip,

There is no new information at this time, unfortunately.

Best regards,

This is really bad news .. my company requires the MFA authentication

it is activated at SecretServer and we are not more able to access the stored password from RDM .. i bet a RDM replacement discussion will start soon

Would be too bad, as we all love your product :(

Robert

This is really bad news .. my company requires the MFA authentication

it is activated at SecretServer and we are not more able to access the stored password from RDM .. i bet a RDM replacement discussion will start soon

Would be too bad, as we all love your product :(

Robert

Hi Robert

If you've enabled the MFA on the user object in Secret Server you should be able to use this in RDM. Just enable the setting in the general section of the secret server entry in RDM, explained in step 4.2 on this RDM KB: Secret server entry configuration - Devolutions

BR

Philipp

This is really bad news .. my company requires the MFA authentication

it is activated at SecretServer and we are not more able to access the stored password from RDM .. i bet a RDM replacement discussion will start soon

Would be too bad, as we all love your product :(

Robert

Hi Robert

If you've enabled the MFA on the user object in Secret Server you should be able to use this in RDM. Just enable the setting in the general section of the secret server entry in RDM, explained in step 4.2 on this RDM KB: Secret server entry configuration - Devolutions

BR

Philipp

We are just testing Secret Server with internal MFA with RDM and I confirm it is working.

sorry my fault .. my company is using Azure AD with SAML :(

so the described option is not solution for us

we're in the same boat, we've established our structure in RDM and would like to keep it. In the link I've attached it is mentioned that the SAML authentication should be supported from RDM version 2023.1 onward and we were kind of relying on this, but about nine months later after the release of 2023.1 there is still no sign of this implementation. I don't know of any other products which offer all the integrations like RDM, so at the moment we're thinking about starting with the AD integration of the users and move to SAML after RDM is able to. This is causing some major delays in our project but we don't see other ways atm.

we're in the same boat, we've established our structure in RDM and would like to keep it. In the link I've attached it is mentioned that the SAML authentication should be supported from RDM version 2023.1 onward and we were kind of relying on this, but about nine months later after the release of 2023.1 there is still no sign of this implementation. I don't know of any other products which offer all the integrations like RDM, so at the moment we're thinking about starting with the AD integration of the users and move to SAML after RDM is able to. This is causing some major delays in our project but we don't see other ways atm.

Right , this is really disappointing .. my company is unfortunately not waiting for RDM to get this working : SecretServer is already switched to SAML (as well as many other services). So using RDM is not Impossible anymore, but we lost a lot of comfort and functionality. And the bigger the pain gets , the louder the discussion gets about replacing to a product which is able to handle this

Hello Together,

we are also awaiting the SAML integration method. I understand if it is hard to code.

9 months ago I mentioned in my post the possibility of using the user's API token (bearer token, actually) which can be put to the clipboard. This way the SAML authentication burden would be off from Remote Desktop Manager, as the user would perform this in her browser. Only the URL and this token field would be required for the credential entry. @Richard: Was this considered? Because that might be a quick win, even if it is not as convenient as a SAML logon page.

Best regards,

Zsombor

We could definitely live with a workaround described by Zsombor if it would mean that we could use the SAML in Secret Server. Please reconsider if this is a viable solution. Is there maybe a forum on Delinea about this topic where we can try to push the topic further if it's dependent on the Delinea API?

to me this sounds quick and dirty , but if a login page of SecretServer would appear for all the SAML stuff and the API token would be used to gather all following info .. this would be good enough i guess

Hello,

The 2023.3.20 version of RDM Windows is now available (https://devolutions.net/remote-desktop-manager/home/download/). If your Secret Server instance is located in the Cloud, and contains "secretservercloud" in the URL, the SAML authentication is now available.

You will be authenticated in a small webpage, and the OAuth token will then be re-used in RDM to access the Secret Server credentials.

If it works properly, we will see if it is implemented on on-prem environments.

Best regards,

Hi Richard

This is great news, we'll test this new feature in the course of the next week and I'll report back here.

BR

Philipp

This sounds promising .. looking forward to the On-Prem function .. do you have any time estimations ?

Robert

Hello Richard!

Thank you for the good news! Together with me, 81 IT admins are appreciating your efforts and looking forward to it!

Best regards,

Zsombor

Hello Robert,

Currently, the SAML authentication is only available for the Cloud version of Secret Server. If we receive enough positive responses from the community that it works correctly, the developers will look into adding the functionality to the on-premise version.

Best regards,

Too bad :(

version 2023.3.20.0 was working with our On-Prem solution with SAML .. all we were looking for was working

but now i can see there was a "fix" at 2023.3.22.0 with the comment "Fixed Secret Server on-premise authenticating with web login instead of oauth"

i fear this will disable the SAML ability in our Env ... so this is no fix for me :(

i'll definitly stay on 2023.3.20.0 until you fix the fix again :)

robert

Hello Robert,

We will update this thread when it is available again.

Best regards,

Hello Robert,

In the latest version (2023.3.24), an SSO authentication mode will work with the Cloud and on-prem, whether the SSO is active or not. OAuth mode is recommended for users who do not have SSO so that login is automatic.

Best regards,

Changed the my Priv Cred setting to SSO

I've been ask to provide my password .. but i'm missing the web window for the SAML login ... how does this work?

Which account is taken ?

i our case we may have different accounts for Secret Server and RDM SQL Database .. so i guess it might get mandatory to have this web login window

it would be at leased more transparent .. any idea who i can bring this back ?

Robert

Hello Robert,

When you connect to your data source in RDM, when you open it, for example, it will prompt you to login to your Secret Server instance in a browser.

The username used is the one that you used in the browser window, it is not saved in RDM (the fields are grayed out).

Do you have the same issue after you close and re-open RDM?

Best regards,

Hello Richard!

I had the time now to setup our Secret Server in RDM (v2023.3.28 at this moment), and I must say, Devolutions engineers did a superb job! Our Secret Server, with SSO login, with corporate customizations, with Azure login, works perfectly. There are many search options as well and I find the possibility of mapping the logon field names to template field names very good. The speed is also very good. So, 84+ IT admins -- including me -- thank you sincerely for doing this integration!.

The only thing I got confused with is the "lookup method" as there are some cases where the results are either more or less than I expect, but this is more like an advisory support case and not a thread to be discussed here.

It is rare that a custom feature request posted in a forum gets implemented in such a good quality. Thanks and keep up the good work!!

Best regards,

Zsombor

Hello Zsombor,

Thank you for the kind words; I shared them with the developer who worked on the integration.

For other users, we also have a quick guide to configure the SSO - https://docs.devolutions.net/kb/remote-desktop-manager/how-to-articles/delinea-secret-server-sso/

For the "lookup method", most users use the Prompt for list and then select the account in the entries. See point 3 and 4 of https://docs.devolutions.net/kb/remote-desktop-manager/how-to-articles/secret-server-entry-configuration/

Best regards,

Hi All

It took us a bit longer than originally planned, but now we've integrated the Secret Server with SAML and can report back that it works great from RDM.

Thank you for implementation of this feature which saved us quite a lot of time.

The only question I have is if it necessary to have the credentials saved in the Secret Server Settings under "My Account Settings"? Will there be also a SAML implementation with Tokens instead of fixed credentials in the future or will it stay this way?

Best regards

Philipp

Hello,

To avoid future confusion, we'll disable My Account Settings and Windows Authentication checkboxes when SSO is selected, since they have no effect.

Regards

Hi everyone

Thank you for clearing this up, I can confirm that after removing the check on "Use My Account Settings" and clearing the SecretServer Account Settings everything is working fine.

Best Regards

Philipp

Hello Philipp,

Excellent, thank you for confirming it now works.

Best regards,