Florian Darras

Here is a response from the Forti staff:

Hey,

technically, the FortiToken mobile seeds can be exported during provisioning, under VERY specific circumstances.

Please check here: https://docs.fortinet.com/document/fortiauthenticator/6.6.1/rest-api-solution-guide/829822/local-use...

There is a section 'Third party integration: FTM provisioning' that goes into a bit of detail.

 

However:

- this requires use of a FortiAuthenticator, and the FortiToken mobile licence must be attached to that same authenticator

- the seeds ARE returned in an encrypted format, but I don't know if the Remote Desktop Manager can import them

I don't know of any other method to retrieve the seeds; that would indeed require an NFR as DPadula mentioned.

User DPadula sent:

Hi,

To request for a new feature you need to contact your AM on Fortinet, unfortunately this type of request cannot be done via forum. 

I didn't have time to push it further. Let me/us know, if you succeed.

Regards

Thanks for the info, I will check that on my side (I will also need to have the time to take care of that), I will let you know if I manage to take it further.

Thank you for the check. I created the same question to the Fortinet. So this thread can be closed for now.

Did you have any news on Fortinet's side ? We are facing more and more use of Fortitokens and not having them in Devolutions is a pain to manage for the team currently.

Hello Florian,

Thank you for the follow-up. It's not planned for any releases yet, but the issue is still in our backlog.

On a side note, we recently released the encryption service which greatly simplifies the onboarding process and removes the need for a private key on users. Let us know if you want more information.

Have a good day!

Hello Maxime,

Thank you for the feedback! Any information on that encryption service would be welcome, let me know how we can arrange that.

Best regards,

Florian

Hello,

Thanks for the feedback, I've created a task for this in our backlog.

Have a good day!

Hello Maxime,

Any news on this feature development and the position in your backlog ?

Best regards,

Florian

Currently, when a user enrolls to the password hub, they need to choose the Private Key storage method and can choose between mobile device, QR code or password.

It would be interesting for the administrator of the hub to be able to enforce the use of a certain method (e.g., mobile device, which is more secure than other options).

This could be managed in the users administration and different enforcement could be selected for different group or users or specific users.

For example, I would like to force all users to use a mobile device except 2 users who do not have a company issued phone, who I would like to enforce the use of a password.