+17Hello team!
In case of enabling mfa for ALL users / groups, Im wondering if there is any “backdoor” for admin user.
In case of lost Microsoft Authenticator app and email access, is there any way to restore access to Commcell, even with help of Commvault supoprt?
I cant decide if it’s preferred to enable mfa for all admins (master) users or to leave one admin user without mfa (with a strong password) in case of backdoor.
Please for your thoughts.
Best answer by Nikos.Kyrm
I’m currently facing this issue, I’m doing a DR test restore of the CS, and used the staging option for an environment that is in a bubble. now when I try to login, the admin PWD, I get prompted to enter the MFA token, but it can’t even use it as it is isolated.
In this case, I believe a possible solution is to leave an admin (strong password) backdoor user.
Also, not sure if Commvault Support could assist you.
We've recently introduced a feature to facilitate SAML connectivity testing. This enables you to ensure SAML functionality before enabling it for all users. Furthermore, you can manage associated settings by navigating to the association section. By creating a breakglass user, you can verify that SAML login association doesn't apply to that user. you can setup MFA for this user also using either platform authentication for second factor.
+2I’m currently facing this issue, I’m doing a DR test restore of the CS, and used the staging option for an environment that is in a bubble. now when I try to login, the admin PWD, I get prompted to enter the MFA token, but it can’t even use it as it is isolated.
+17I’m currently facing this issue, I’m doing a DR test restore of the CS, and used the staging option for an environment that is in a bubble. now when I try to login, the admin PWD, I get prompted to enter the MFA token, but it can’t even use it as it is isolated.
In this case, I believe a possible solution is to leave an admin (strong password) backdoor user.
Also, not sure if Commvault Support could assist you.
+13We've recently introduced a feature to facilitate SAML connectivity testing. This enables you to ensure SAML functionality before enabling it for all users. Furthermore, you can manage associated settings by navigating to the association section. By creating a breakglass user, you can verify that SAML login association doesn't apply to that user. you can setup MFA for this user also using either platform authentication for second factor.
SAML works well, but if Entra gets compromised, the backup environment may be impacted as well. At that point, immutability becomes the last line of defense.
I’ve also been experimenting with hardware keys and passkeys. However, on 11.46 (Metallic) there’s currently an issue where they stop working for a reason that hasn’t been identified yet, so I wouldn’t consider this production-safe for now. You also mentioned issues after failover, which is concerning.
There’s also the Break-glass account feature, introduced some time ago, which could be an option here.
I think that if SAML is not in place, MFA for admin accounts combined with username/password or even AD authentication for non-privileged users is a reasonable approach.
The lack of an MFA/2FA token can also be worked around by providing the password and then receiving a TOTP code via email. That somewhat weakens the protection, though, so enabling Quorum/MPA, requiring approval from another administrator, could provide an additional safeguard. It’s annoying, but usually effective. Multi-Person Authorization for Companies
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
