topic Re: MFA for xSOAR portal in Cortex XSOAR Discussions

MFA for xSOAR portal

antjar — Wed, 30 Dec 2020 10:57:49 GMT

Hello,

I am running the Community Edition and have not found anything concerning MFA for xSOAR users. What would be the preferred way to enable MFA for users like Analysts and Administrators?

Re: MFA for xSOAR portal

GShriki — Wed, 30 Dec 2020 19:20:30 GMT

Hi,

Best would be to use an external authentication mechanism that supports MFA. For example any SAML service (like Okta) usually supports MFA for authenticating users for the services.

Gilad

Re: MFA for xSOAR portal

OZamir — Thu, 31 Dec 2020 14:53:56 GMT

@GShriki Is gsuite supported?

Can you point to a how-to article?

TNX

Re: MFA for xSOAR portal

laurence64 — Tue, 05 Jan 2021 20:51:52 GMT

The XSOAR community edition does have a DUO integration that can be specifically used to provide 2fa authentication for admin logins to the portal.

Just go to settings>integrations and either scroll down or type duo into the search bar at the top.

Hope this helps.

Re: MFA for xSOAR portal

GShriki — Thu, 07 Jan 2021 03:07:05 GMT

Hi,

Any standard SAML IdP is supported.

We do not have specific document for gsuite, but you can see the Okta example: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/users-and-roles/authenticate-users-with-saml-20

There are also guides from google on how to use gsuite as SAML IdP...

Gilad

Re: MFA for xSOAR portal

awaneet.chhabra — Fri, 15 Jan 2021 16:12:09 GMT

I want to ask if we can have any other federation (PingID) integrated with XSOAR for MFA?

Re: MFA for xSOAR portal

MBeauchamp2 — Fri, 15 Jan 2021 16:16:21 GMT

You can use Ping for SAML auth, MFA would then enforced on the login with Ping.

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/users-and-roles/authenticate-users-with-saml-20.html#id5486edf0-d397-4fca-8c2e-7aa1aaae8831

While we list Okta, AzureAD, ADFS, you can certainly use other SAML providers like Ping.

Re: MFA for xSOAR portal

awaneet.chhabra — Fri, 15 Jan 2021 16:32:44 GMT

Thanks for the quick response.

We have already tested SAML integration with PingID and it works fine. How do I force it to use Ping, is that something which needs to be configured on Ping side or XSOAR side?

Re: MFA for xSOAR portal

MBeauchamp2 — Fri, 15 Jan 2021 16:45:51 GMT

When you go to login to your XSOAR server, you will see a button "Log in with your Identity Provider (SSO/SAML)". If you have previously setup local accounts in XSOAR, you can disable them, or change the passwords to force users to login with SSO going forward.

Re: MFA for xSOAR portal

laurence64 — Fri, 05 Feb 2021 09:45:36 GMT

Bit late in the day but further to my previous reply I have actually just done a video on my channel about this very thing if you want to take a look it is at https://youtu.be/NvDdTz2CMi4