4 ms·
> It's only available in the Enterprise plan levels. It can be bought separately for Business iirc. > there's no good way of doing this. Through GSuite, agr
by insanitybit 3y ago
> It's only available in the Enterprise plan levels.
It can be bought separately for Business iirc.
> there's no good way of doing this.
Through GSuite, agreed. But you could just configure the 2FA for the downstream service, no? That's what we did at my company.
> There's other applications that you might want to control access to that also have particularly sensitive data where you want to re-verify that someone else hasn't just walked past an unlocked laptop and decided to poke around.
For sure, I'm not trying to argue or debate or anything, was just curious.
- paranoidrobot 3y ago> But you could just configure the 2FA for the downstream service, no? Only if the downstream service supports it. Lots don't, or at least don't enforce it when you come in via SSO. AWS SSO being the one I keep coming back to, because it bugs me so much. For those that do, you now have to also manage the 2FA tokens with that service, using whatever they support. Often that's SMS based 2FA, or maybe TOTP, or their own custom TOTP/Push. Maybe they support FIDO2, but only a single FIDO2 key.
- insanitybit 3y agoYeah makes sense, thanks. I think I'm fine with a 2FA on GSuite login + CAA on subsequent SSOs but I do think it would be nice to be able to force another 2FA for sensitive stuff like AWS. Unfortunately, GSuite seems to move very slowly :\