Setting up two-factor authentication - YubiKey
YubiKey is a physical key made by Yubico, which ensures secure and strong user authentication. You can integrate Yubikey with Password Manager Pro for two-factor authentication.
Summary of steps:
- Configuring two-factor authentication in Password Manager Pro.
- Enforcing two-factor authentication for required users.
Step 1: Configuring two-factor authentication in Password Manager Pro.
- Navigate to Admin >> Authentication >> Two-factor Authentication.
- In the window that opens, select YubiKey and click Save.
- Click Confirm to enforce YubiKey two-factor authentication.
Step 2: Enforcing YubiKey two-factor authentication for the required users.
- Once you confirm YubiKey two-factor authentication in the previous step, a new window will prompt you to select the users for whom two-factor authentication should be enforced.
- Select the required users from TFA Disabled tab and move them to TFA Enabled tab.
- Click on Save.
- You can also select the users later by navigating to Users >> More Actions >> Two-factor Authenitcation.
- In the window that opens, select the users for whom you want to enforce YubiKey two-factor authentication and click Save.
How to connect to Password Manager Pro web-interface when YubiKey TFA is enabled.
The users for whom two-factor authentication is enabled will have to authenticate twice successively. The first level of authentication will be through the usual authentication, i.e., the users have to authenticate through Password Manager Pro's local authentication or AD/LDAP authentication, whichever is enabled.
- Launch Password Manager Pro web interface, enter the Username and Password (local authentication or AD/LDAP), and click Login.
- Once the first level of authentication succeeds, Password Manager Pro will prompt you to enter your YubiKey one-time password.
- Insert the YubiKey into the USB port of your laptop or computer.
- Before generating a one-time password, you need to decide which slot of the YubiKey (slot 1 or slot 2) you're going to use for authentication throughout.
- Slot 1: If you tap the YubiKey once, it generates a 44-character security key whose first 12 characters are unique to this slot. For every subsequent login through this slot, the first 12 characters remain the same and the rest of the 32 characters are randomized.
- Slot 2: If you tap and hold the YubiKey for 2-5 seconds, it generates a 44-character security key whose first 12 characters are unique to this slot. For every subsequent login through this slot, the first 12 characters remain the same and the rest of the 32 characters are randomized.
- Here's a sample output from a YubiKey where the button has been pressed three times.
- Password Manager Pro matches the 12-character key against your account in its database and verifies the same for the second level of authentication during future login attempts.
- After submitting the YubiKey one-time password, click on Register and Login.
Note : By default, YubiKey generates slot 1 passcode for the NFC configured mobile devices. You can set slot 2 passcode as default by changing the setting from slot 1 to slot 2 using the Yubikey Personalization tool.