-
Title
Importing Yubikey into Defender when Yubikey not purchased from One Identity -
Description
When Defender customers receive Yubikey tokens from One Identity, they are provided with an import file that must be formatted properly.
How can this file be properly created if the Yubikey and import file was from a 3rd party? Yubikey provides a configuration tool for this purpose, but what options must be selected? -
Resolution
For Yubikeys received from Quest, please refer to the Defender Token Support for Yubikey guide, which may be downloaded here: Defender - Release Notes and Guides.
For Yubikeys that were purchased from a 3rd party you will need to download the Configuration tool from Yubikey directly: http://www.yubico.com/products/services-software/personalization-tools/.
1, Using the “YubiKey Personalization Tool” got the Settings tab
2. Set the "Log configuration output" to "Flexible Format", "{serial},{secretKeyTxt},{oathMovingFactorSeed}"
To program a token
1. Select the "OATH-HOTP" tab | Advanced
2. Select "Configuration Slot 1"3. Uncheck the “OATH Token Identifier (6 bytes)”
4. Ensure “HOTP Length” is set to 6 digits, NOT 8
5. Set the “Moving Factor Seed” to “Randomize”
6. Click “Generate” for the “Secret Key”
7. Click “Write Configuration”, this will write the configuration to the key, and create a CSV file.
The CSV log output from the tool can be then imported into Defender from Active Directory Users & Computers | Defender menu | Import Tokens | Click Browse | Select "All files" on the drop down, and point to the CSV file | Click Open | Leave the "Key" blank | Click Next