simonbaker

Yep sure (Company name redacted). This is using the Confluence Login page from My Accounts, but I get the same from the CyberArk PWVA. I have tried starting a new session as well.

More details gives you this.

Hi there,

Keen as ever I noticed the release notes mentioned this for 2023.1.23.0 Release Notes - Remote Desktop Manager (devolutions.net)

However the device ID is still not being passed through so Conditional Access fails.

Regards,

Simon

Hi,

I am having the same issue with Conditional Access and it appears to be that the embedded browser does not pass the device id as part of the sign-in.

For my example this is using SAML for CyberArk which works perfectly in Edge, but fails in RDM as the device ID is not passed so it fails conditional access.

Thanks,

Simon

This url is outside of our platform, it should redirect you to login.microsoft.com.

We will need to enable dev mode in your browser and see where it hangs, its best to move to a ticket and have a second line specialist help you. I have located your account and will open a case for you.

Best regards,

As far as I can tell it is our PVWA server returning the 404 do you have a relay url example to Cyberark? I will raose woth them as well.

Not working for me as I get a 404 error.

Thank you, I can confirm the module license is resolved in our environment now.

Hi Richard,

I’m using the same credentials on other website sessions without issue on systems such as SOTI and Vmware Vcenter. I agree it doesn’t work on an external browser only when embedded and a fee of the sites just need a macro to press the enter key but the credentials autofill without any issue.

Office 365 is a challenge though due to the separated pages during login.

Thanks,

Simon

Hello,

Yes absolutely here you go.

Hi,

Yes RDM is on the latest version 2022.2.23.0

I also have an issue getting the right entry in as CyberArk stores the username from AD and of course it needs to go into 365 as the UPN which is different in 365 to the one on internal AD.

Thanks,

Simon

Hi again,

I have given this a test and because the username and password are on different pages this doesn't work but the field IDs are correct.

Additionally the entry needs to append the primary 365 domain to the end of the username which is different from the internal UPN.

Let me know your thoughts?

Simon

So just to confirm those are the login ids for the Office 365 login fields.

Just going to revisit this and ask if this works with an entry from the User Vault when you are doing "Find by Name (User Vault)" from the DVLS server.

I have ticked all the boxes and am still getting $PASSWORD$ also the UserVault entry is a CyberArk PVWA linked entry.

Obviously I would prefer a better solution as I am not keen on the security risk of the password potentially being typed elsewhere even though it is a unique one for each user.

This has made my day!

Looking forward to this for quite a while now, so how much longer?

Hi,

You should have received a trace to support now.

If not here is a screenshot from one of our users.

Hi,

The Data Source in question is DVLS and the portable version is being used with the same Data Source exported and imported to the portable version.

Are there any logging options we can enable to get more information on either end?

Thanks,

Simon

Thanks for the answers, can we get a date when the packager will be updated to create the custom installer for the right version?

I came here to look for the answer to this as I already have someone who has had to reinstall (because they did not listen to the "Do Not Update" comms we send out.

So in the words of 4 Non Blondes:

"Hey! What's going on"

Also is there a best practice method of answering the chicken and egg question of which you upgrade first DVLS or RDM?

Thanks in advance

Simon

Maurice,

Any news on this, our adoption of Devolutions with CyberArk is blocked by this as we chose to adopt SAML authentication.

Simon

Hi,

This is useful for RDM, but what about DVLS? It is the DVLS server I am looking here.

Thanks,

Simon

Just an update on this thread for those that come across it, we finally settled on AD authentication as the Azure side is not quite at parity feature wise as on premise AD. Also to access the data source and indeed the servers our users need to be on the network or VPN, so there was no real benefit to using Azure authentication for us.

This may be a really easy one but I cannot find it anywhere in the documentation or forums.

Is there a list of URLs/IPs to allow outbound to the internet for Devolutions Server?

Updates comes to mind as one, although that could be downloaded then moved to the server perhaps then it could just be a total block on internet access.

This doesn't tally with what I am experiencing as my settings are 1 day and I am getting prompted within that timescale.

I have not changed that setting but have stopped and started the server.

Hi,

I have upgraded my brand new environment not yet in Production to DVLS 2022.1.9.0 and RDM 2022.1.12.0.

I have 365 Authentication working after creating a new data source entry in RDM as the old one would not work for 365, although I notice that the sessions do not appear to be persistent and I get a lot more authentication prompts for 365. As you can see below I have three in the space of two minutes for RDM.

Is this expected behaviour (if it is its not very user friendly) or are there some changes I need to make as I notice the Datasource entry now has less details.

Excellent responses guys,

We are fully in the AAD ecosystem and the on-premise side of the hybrid is purely for internal servers and services.

Leaning on the Office 365 side will there be more development to get the offering on a par with the AD Domain side so that auto create of new users happens for just the groups you have chosen instead of all users.

A feature to assign licences by group would be great on the Office 365 side as well.

Hello again,

Is it possible to define permissions within a vault so that different groups of users only see their portion of the tree.

As an example we have three sets of users using a vault.

Set 1 - Needs to see all the entries covering two brands which are in sub-folders for the respective brand.

Set 2 - Needs to only see one of the brands sub-folders and children.

Set 3 - Needs to only see the other brands sub-folder and children.

I appreciate that we could set up separate vaults, but "Set 1" would end up continuously changing vaults to support the two brands and then the entries would need to be updated in more than one place.

Thanks.