https://netsuiteprofessionals.com logo
Join Slack
Powered by
Thanks for the info <@U9GFN16J2>. Please keep me u...
# general
e
Thanks for the info @GeneralKenobi. Please keep me updated on what you find out. I am going through NS support now as well to see if they can assist me.
a
1. Get your list of integration users (Setup > User/Roles> Access Tokens). This list must contain one of the accounts causing the issue. 2. From that list, focus on any Administrator or Full Access roles 3. Run a Login Audit Trail for those accounts. Group by email, role, application to see which are in use. Use a date filter (within previous 1 month) to lessen the results and speed up the search) If Application is empty/null then it is using password based login. Specific identification will be a problem only if an actual employee record is also being used for integration (bad practice).
g
Thanks for the tip @Automatech I did as you instructed above and all check out no empty application ID's
a
If you received the notification you can also contact support and ask for the specific list of users. This is probably the easiest method. Sorry that didn't help.
g
No worries i have a case open already this morning.
e
@GeneralKenobi NS Support called me and we did a zoom call. Here is the email they sent after: We navigated to Setup > Users/Roles > Two-Factor Authentication > Two-Factor Authentication Roles (Administrator). For each role that NetSuite has marked as Mandatory 2FA Required (denoted by the check mark in the Mandatory 2FA column), we changed the value in the Two-Factor Authentication Required column from Not required to 2FA authentication required. Listed below are some additional resources for you to review: •Permissions Requiring Two-Factor Authentication (2FA), SuiteAnswers ID 70234 •Mandatory Two-Factor Authentication (2FA) for NetSuite Access, Suite Answers ID 76766 •Token-based Authentication, SuiteAnswers ID 41827 •OAuth 2.0, SuiteAnswers ID 91092
@Automatech
Essentially, just changed any roles that were "mandatory 2fa" to 2FA authentication required
k
Honestly, it sounds like NS support led you astray - that doesn't change the root of the problem.
e
Damnit.
k
Which is that you have a login that is hitting 2FA required role with web services/restlet
So all you did was "expedite" how fast your login is going to fail
I guess you'll find out which logins aren't working when stuff breaks.
Which I suppose - kind of solves the problem of figuring out "what is going to break that isn't currently breaking"
a
actually, yes. You should be getting failures in the login audit trail quite quickly
e
Is there a way for me to try to determine which webservices/logins are using the 2FA incorrectly>?
a
or as infrequent as the connection is (at worst probably daily)
e
I know we have Celigo integrations running every 15 mins
k
Well - if it fails in the next 15/20 minutes, you should be able to see it in the login audit trail...
a
you should actively watch, otherwise it will get locked out and it'll take a bit longer (30 minute wait time) for it to be functional again.
e
Yeah, I'm just refreshing the page every minute or so
a
probably not a bad idea to set up saved search notifications for failures anyway
e
So our Celigo Integrations both ran, and there were no failures
and not just "ran", but created record in NS with success.... I'm so confused
k
Then you have some other integration that triggered their search.
e
Is it possible that one of our integrations was connecting with login/password and then was updated to use Token, but the login/password method was just never removed?
a
Not sure that'd really be the issue. I've only seen the situation where Prod was updated to token and Sandbox left at password (resulting in lockouts b/c of shared email -- another thing to avoid).
it sounds like they are identifying it based on the fact that it is an integration. So that implies the offender is in your integration list. Given that, I'd expect the access token to exist. so at a minimum you can go into each integration individually to identify the ones that allow password based auth. Then find the access tokens for those integrations.
the access token is just saying "this user will use this application" -- i think it's still necessary for password based auth, but I can't remember 100%
you can also check with NetSuite to verify if that notification was for just Production or it included sandboxes. Maybe your prod is fine and it's just sandbox.
e
^^^ Ill look into that
2 Views
Open in Slack
PreviousNext
Powered by