Store sensitive plugin data securely
Store sensitive plugin data securely
By default, the configuration of the plugin is stored on SPS in the configuration of SPS. Make sure that you store the sensitive parameters (for example, api_key) of the plugin in an encrypted way.
To store sensitive plugin data securely
-
Log in to SPS, navigate to Policies > Credential Stores and create a Local Credential Store. For details, see Configuring local Credential Stores in the Administration Guide.
Instead of usernames and passwords, you will store the configuration parameters of the plugin in this Credential Store.
-
Add the plugin parameters you want to store in an encrypted way to the Credential Store. You can store any configuration parameter of the plugin in the Credential Store, but note that if an option appears in the Credential Store, the plugin will use it. If the same parameter appears in the configuration of the plugin, it will be ignored.
-
Enter the name of the configuration section without the brackets in the Host field (for example, okta).
-
Enter the name of the plugin parameter in the Username field (for example, api_key).
-
Enter the value of the plugin parameter in the Passwords field.
-
Click 
.
-
Navigate to the configuration of the plugin on the Policies > AA Plugin Configurations page.
-
In the plugin configuration file, enter the name of the local Credential Store under the [credential_store] section as the value of the name parameter.
-
Enter $ as the value of the parameter storing sensitive data.
Perform multi-factor authentication with the SPS Okta plugin in terminal connections
Perform multi-factor authentication with the SPS Okta plugin in terminal connections
The following describes how to establish a terminal connection (SSH, TELNET, or TN3270) to a server.
To establish a terminal connection (SSH, TELNET, or TN3270) to a server
-
Connect to the server.
If you can authenticate using an OTP or token, encode the OTP as part of the username. You can use the @ as a field separator.
Example:
ssh otp=YOUR-ONE-TIME-PASSWORD@user@server
Replace YOUR-ONE-TIME-PASSWORD with your actual OTP.
If needed, you can specify the type of OTP as a prefix to the OTP. For example, to specify the OTP of a YubiKey token:
ssh otp=y_YOUR-ONE-TIME-PASSWORD@user@server
-
If SPS prompts you for further information, enter the requested information. If you need to authenticate with an OTP, but you have not supplied the OTP in your username, you will be prompted to enter the OTP.
-
Authenticate on the server.
-
If authentication is successful, you can access the server.
Perform multi-factor authentication with the SPS Okta plugin in Remote Desktop (RDP) connections
Perform multi-factor authentication with the SPS Okta plugin in Remote Desktop (RDP) connections
The following section describes how to establish a Remote Desktop (RDP) connection to a server when the AA plugin is configured.
To establish a RDP connection to a server when the AA plugin is configured
-
Open your Remote Desktop client application.
-
If you have to provide additional information to authenticate on the server, you must enter this information in your Remote Desktop client application in the User name field, before the regular content (for example, your username) of the field.
If you can authenticate using an OTP or token, encode the OTP as part of the username. To encode additional data, you can use the following special characters:
Example:
For example, use the following format:
domain\otp~YOUR-ONE-TIME-PASSWORD%Administrator
Replace YOUR-ONE-TIME-PASSWORD with your actual OTP.
If needed, you can specify the type of OTP as a prefix to the OTP. For example, to specify the OTP of a YubiKey token:
domain\otp~y_YOUR-ONE-TIME-PASSWORD%Administrator
-
Connect to the server.
If you need to authenticate using a push notification, approve the connection in your mobile app.
-
Authenticate on the server.
-
If authentication is successful, you can access the server.
Perform multi-factor authentication with the SPS Okta plugin in Microsoft SQL Server (MSSQL) connections
Perform multi-factor authentication with the SPS Okta plugin in Microsoft SQL Server (MSSQL) connections
The following section describes how to establish a Microsoft SQL Server (MSSQL) connection to a server when the AA plugin is configured.
To establish a MSSQL connection to a server when the AA plugin is configured
-
Open your SQL client application.
-
If you have to provide additional information to authenticate on the server, you must enter this information in your SQL client application in the User name field, before the regular content (for example, your username) of the field.
If you can authenticate using an OTP or token, encode the OTP as part of the username. To encode additional data, you can use the following special characters:
Example:
For example, use the following format:
domain\otp~YOUR-ONE-TIME-PASSWORD%Administrator
Replace YOUR-ONE-TIME-PASSWORD with your actual OTP.
If needed, you can specify the type of OTP as a prefix to the OTP. For example, to specify the OTP of a YubiKey token:
domain\otp~y_YOUR-ONE-TIME-PASSWORD%Administrator
-
Connect to the server.
If you need to authenticate using a push notification, approve the connection in your mobile app.
-
Authenticate on the server.
-
If authentication is successful, you can access the server.
