MFA for xSOAR portal

[antjar]

Hello,

I am running the Community Edition and have not found anything concerning MFA for xSOAR users. What would be the preferred way to enable MFA for users like Analysts and Administrators?

[GShriki]

Hi,

Best would be to use an external authentication mechanism that supports MFA. For example any SAML service (like Okta) usually supports MFA for authenticating users for the services.

Gilad

[OZamir]

@GShriki Is gsuite supported?

Can you point to a how-to article?

TNX

[laurence64]

Hi

The XSOAR community edition does have a DUO integration that can be specifically used to provide 2fa authentication for admin logins to the portal.

Just go to settings>integrations and either scroll down or type duo into the search bar at the top.

Hope this helps.

[GShriki]

Hi,

Any standard SAML IdP is supported.

We do not have specific document for gsuite, but you can see the Okta example: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/users-and-roles/authent...

There are also guides from google on how to use gsuite as SAML IdP...

Gilad

[awaneet.chhabra]

I want to ask if we can have any other federation (PingID) integrated with XSOAR for MFA?

[MBeauchamp2]

You can use Ping for SAML auth, MFA would then enforced on the login with Ping.

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/users-and-roles/authent...

While we list Okta, AzureAD, ADFS, you can certainly use other SAML providers like Ping. 

[awaneet.chhabra]

Thanks for the quick response. 

We have already tested SAML integration with PingID and it works fine. How do I force it to use Ping, is that something which needs to be configured on Ping side or XSOAR side?

[MBeauchamp2]

When you go to login to your XSOAR server, you will see a button "Log in with your Identity Provider (SSO/SAML)".   If you have previously setup local accounts in XSOAR, you can disable them, or change the passwords to force users to login with SSO going forward.

[laurence64]

Bit late in the day but further to my previous reply I have actually just done a video on my channel about this very thing if you want to take a look it is at https://youtu.be/NvDdTz2CMi4