https://netsuiteprofessionals.com logo
Join Slack
Powered by
On a different topic, we are also aware that the D...
# sdf
d
On a different topic, we are also aware that the Developer role which we released in 19.1 has been designated as requiring Two Factor Authentication (2FA). The current plan is to fix this in the next release, 19.2, but there are a couple different actions you can take now to resolve this issue if 2FA is a blocker for you: 1. You can create a customized Developer role for your own use that will not require 2FA. To do so, visit the Manage Roles page and click the Customize button next to the Developer role. Under Permissions, remove Integration Applications from the Lists tab and remove both Integration Application and Access Token Management from the Setup tab. Save your new role and use it with SDF. The role should not require 2FA. We plan to remove these permissions from the built-in Developer role next release. Should you need an integration application to create access tokens against, you should install the SuiteCloud Development Integration bundle (ID 245955), which provides an integration application to create access tokens against. To install that bundle using your customized role, you should also add the SuiteApp Marketplace permission under the Setup tab (to be added to the Developer role in 19.2 as well). 2. You can also use our token saving functionality to work with roles requiring 2FA. The first step is to generate a user access token for that role in the NetSuite UI. Then, in the SDF IDE, visit the Manage Accounts page, select the account you generated the token for, select Manage Authentication, and then Save Token for the role requiring 2FA. If you are using the SDF CLI, you can do the same using the 
savetoken
command.
s
I've been using option 2 exclusively
b
Wouldn't the best option actually be utilizing TBA?
Just because something is slightly more difficult doesn't mean that it's not the right solution lol. A developer's credentials get hacked, now someone can deploy malicious code to their production environment. The odds of their credentials AND their access tokens being simultaneously hacked? much smaller
Then again, if the developer can manage access tokens from the same account that is hacked, someone could just go in and create an access token and start deploying, so removing those permissions, requiring an admin account with 2FA to create access tokens for the developers, and then requiring the tokens in the SDF would be the best form of security, I'd say
s
both the options above are TBA. the issue in question was 2FA not TBA
b
right, but there is something to be gained by forcing 2FA for people who have access to deploy customizations to your your platform, right?
s
yes 2FA is added security in all cases
b
so I'd argue that saying the "suggested method" should be to use the bundle to allow TBA with 2FA accounts, not the one to get rid of 2FA
s
oh, you mean swap option 1 and option 2? I'd agree with you there
b
yeah
Copy code
but there are a couple different actions you can take now to resolve this issue if 2FA is a blocker for you:
The first one would be, "suck it up and worry more about security than your convenience" lol
s
security vs convenience have been battling it out since the beginning 🙂
b
lol indeed
unfortunately, too many take the wrong route lol
and then when their Netsuite production gets all hacked they will blame Netsuite for their laziness
so as a CYA for Netsuite, I'd say, "2FA FOR ALL!"
s
I do like how DUO uses push notifications for 2FA approvals... makes it less trouble
b
yeah. Facebook, Twitter, etc.. also have things like that. Sends a "Is this you?" directly to your phone and you just press "yes" and you're done
f
But pretty much what you are asking for is 2FA for any operation you perform through the SDF-CLI
b
that's what the TBA bundle handles
I mean, thinking of the IDE, I think it's pretty dangerous to have the deploying of development and sandbox accounts right next to, and without much warning or anything, the ability to deploy to production
but I come from the tradition of decoupling database migrations and deployment completely from the core code
I'm primarily a back-end php developer and the vast majority of my experience in Netsuite has been on the SOAP API
d
Sorry for the wonky ordering! Wasn't necessarily endorsing either option in this case, unlike the other post. I'd agree that we built those TBA features for a reason 🙂
3 Views
Open in Slack
PreviousNext
Powered by