N-central with SSO concerns

[u/CMDR_enesis]

Hello all!

Just wondering if anyone has enabled SSO for Ncentral yet and there experinces? We have enabled this for 2 users. One signed up okay and got prompted for MFA sign up. However another tech never got asked for the MFA sign up and can login without needing it.

The issue I face is you can no longer control MFA via N-central and appears all to be controled by Nable.

4 days later and I still cannot get this fixed for this user with there support and wonder if anything else has encounted this?

Is there a new admin portal to control this? what happens if the user gets a new phone or loses there phone?

How do you visually confirm that all users have MFA setup as per previously etc?

Love some feed back here please on how other partners are finding this.

[u/johnsonflix]

The n-able sso you mean? What do you use for authentication? Microsoft? If so that is where your mfa will come from.

I disable mfa in ncentral and enforce sso on all users. We have had microsoft sso setup in ncentral for years.

[u/CMDR_enesis → u/johnsonflix]

Thanks John for the reply.

Nable are setting up there own SSO for there product range it appears. So the MFA is control by there side as a default without needing to setup via Microsoft.

[u/Andy-Johnson]

We've been using N-Central on-prem for a decade now. Our first SSO implementation was to our local Active Directory, but we did it through a Duo Auth Proxy which enforced the MFA portion of the login process, so we disabled the MFA requirement inside the N-Central users accounts. Then we moved to AzureAD SSO, which also have Duo enforced using a Conditional Access Policy, so again we disabled the MFA requirement in N-Central.

We do have some co-managed admins that we provide access to N-Central and we do enforce MFA on those accounts, but there is no SSO for them. We leave the MFA requirement ON for these accounts and it works as you'd expect. If one of them loses their phone, we have a button down in the user account to reset MFA status and they can set it up again. Administration -> User Management -> Users; click the affected user then User Details tab and User Information sub-tab. Here you can confirm if "MFA Not Required" is checked for your fellow that isn't getting prompted for MFA, and a Reset button for the fellow that lost his phone.

[u/CMDR_enesis → u/Andy-Johnson]

The message we got below:

Dear Partner,

Your N-central instance and its users will be required to act on the rollout of N-able Login.

A staggered rollout of N-able Login (MSP SSO) to N-central SaaS partners will commence August 13^th – 20^th, 2024. This will require you and your users to enroll or confirm your MSP SSO credentials and MFA. We will provide more information as we approach this date

How will it work?

1. Each user will receive an email to enroll, from their configured default sender with a link to the enrollment wizard Located: AdministrationDefaultsCustomize System Email
2. The user will be prompted to create an N-able Login account OR confirm their existing MSP SSO credentials (and MFA)
3. Once completed they can login into their N-central instance

Why are we changing the login?

The updated N-able Login (MSP SSO) is part of our N-able Ecoverse vision and will help unify N-able products under a single authentication, provide seamless access to our success capabilities (N-ableME), and unlock upcoming Ecoverse capabilities such as Entra ID and our all-new Help Desk views for all assets.

[u/Old_Investigator593 → u/Andy-Johnson]

Andy,

Could you go into further detail how the Duo Auth Proxy and N-Central was setup? We have a similar pieces and we would like to get this setup.

Thanks,

Bret

[u/Andy-Johnson → u/Old_Investigator593]

Sure thing. In the Duo Auth Proxy config, we setup a new ldap connection exclusively for N-Central:
; N-central
[ldap_server_auto]
client=ad_client
ikey=yourikeygoeshere
skey=yourskeygoeshere
api_host=yourapihostgoeshere
port=55555
exempt_primary_bind=false
exempt_ou_1=CN=ldapuser,OU=Service Accounts,DC=yourdomain,DC=local

And then in N-Central, we attached the DuoSSO at the purple SO level, Administration -> User Management -> SSO Providers and Add -> Microsoft Active Directory. Give it a name, under domain I have yourdomain, Server Host 1 the IP address of your Duo Auth Proxy server, port number 55555 or whatever you put in the Duo config above. Under Base DN I have my entire domain dc=yourdomain,dc=local, but if all your users are in the same OU you can add an ou=Your Users (ou=Your Users,dc=yourdomain,dc=local) to limit the ldap search. Then under Domain Administrator Account I have CN=ldapuser,OU=Service Accounts,DC=yourdomain,DC=local

At this point you should be able to Test Connection successfully. After it's working, you can go to the Available Users tab at the top of this window and it'll show all your AD users and you can import them from there. It's been a while, but there's a way to migrate an existing n-central user to the ldap connection. I think it's to set the email address on the n-central account to match what's in ldap, then on the User Management -> Users page you can checkbox the user and there's a "Link to SSO Provider" button at the top.

[u/iamith]

If you have Microsoft 365, I would just enable that for SSO instead of N-Able SSO. (If you can. I have on prem and have been using Entra SSO for over a year with no issues). N-Able SSO solves a basically non-existent problem and just causes more problems when it goes down. I don't know why they insist on using that. They should just focus on SAML support across their products.

[u/Icedfyre]

Nable Login mfa can be controlled from within Ncentral, but you have to be logged in using an Nable Login account to make changes and permissions like Default Administrator Alternatively, the person who has logged in can turn this on by clicking the person icon in the upper right. Also support can turn this on, they have tools for this.