rvandolson

Nope, agreed. I think SS either needs to extend its web services API or Okta needs to modify how their RADIUS-based authentication works.

Have discussed further w/ Thycotic, and seems that our Okta-based integration is a two-step challenge/response process. In the first step, the username/password are passed to Okta, and only after that can we send back the MFA code.

Via the AuthenticateRADIUS call, obviously all the variables are sent through at once which Okta doesn't like.

So perhaps a change is needed on the Okta side, or a new Web Services call on the SS side... we're going to see if we can coordinate on getting all three of you together (unless that's something you already have a channel on).

I'm curious -- could someone from Devolutions (or a user) confirm that this integration was working with Secret Server? Thycotic is telling us that the AuthenticateRADIUS call does *not* support MFA, but that doesn't sound right...

Thanks, Hubert!

Very interested in testing in your beta. When do you anticipate that being available and is there anything required to be able to participate?

Sure, sorry about that! RFE = Request for Enhancement (what I just posted in your feature request form) and PS = Professional Services (thinking you guys could prioritize the implementation via a paid engagement from either us or other interested customers).

Done.

Do you guys offer any sponsored RFE type work? Perhaps as a PS engagement?

See also this thread.

Would like to see RDM extended to better work with Secret Server two-factor authentication. This *likely* involves using authenticateRadius instead of authenticate, or intelligently handling a switch between the two as appropriate.

This would let users enter in their two-factor code one time into RDM to obtain a SS API token which could then be used for the duration of the user's session (or until some predefined expiry time).

Yes, RDM throws a popup... however it only asks for Org, Domain, Username and Password.

With that said, perhaps it's smart enough to prompt for additional fields if SS requests them? If RDM is using AuthenticateRADIUS:

https://secretserveronline.com/webservices/sswebservice.asmx?op=AuthenticateRADIUS

... and additional radiusPassword field is reqeusted.

We may have to just give this a try.

Hmm.... may come down to whether or not RDM is using the AuthenticateRADIUS call and can provide the RADIUS password via user prompt....

We're using RDM with Secret Server. Works great, but we're wanting to protect Secret Server with two-factor authentication.

Is this guaranteed to break our SS integration? Or maybe there's some way for API "stuff" to be excluded from two-factor requirements or leverage some sort of expiring token type system?

We'll check with Thycotic as well but curious if any of you out there are doing integrations with SS or other password managers with two-factor in the middle.