Skip to main content
commvault.com commvault.com

I started looking at the MFA on Command Centre and baffled as it is flawed. If my domain account has been compromised, I would be expecting the second factor to be the 2nd line of defence. But no, you can request a new pin that gets sent to your compromised domain account e-mail address. I then looked to see if I can amend my account by adding an external e-mail address, but LDAP pulls this from the domain and can not be edited. By editing the e-mail script we can omit the pin, but I think this hasn’t been thought through by Commvault, considering that backups are supposed to be the last line of defence against a cyber attack the two factor serves only to delay the time it takes for SMTP to deliver a new pin.

@dude  In other words, yubikey option doesn’t get invoke, when we do SSO.  In case of ADFS, yubikey support need to be added in AD. When token comes back to us, user is already marked authenticated. Internally we have tried yubikey with Azure AD setup and it worked fine. Currently we are adding feature to allow local or direct AD user authentication with yubikey.

 

 

 

 

@Anand I`m not sure I understand. It is currently not supported but it is coming in future release? do you  know when?

@dude , let me know if @Anand ‘s reply satisfied your question :nerd:

@dude  In other words, yubikey option doesn’t get invoke, when we do SSO.  In case of ADFS, yubikey support need to be added in AD. When token comes back to us, user is already marked authenticated. Internally we have tried yubikey with Azure AD setup and it worked fine. Currently we are adding feature to allow local or direct AD user authentication with yubikey.

Editing in FR25 to mark this as the best (and complete) answer.

 

 

 

 

@Anand any way to get ADFS and allow Yubikeys?

Reply


Terms & ConditionsCookie settings