YubiKey for Salesforce

Transcription

2 Copyright 2016 Yubico Inc. All rights reserved. Trademarks Yubico and YubiKey are registered trademarks of Yubico Inc. All other trademarks are the property of their respective owners. Disclaimer The contents of this document are subject to revision without notice due to continued progress in methodology, design, and manufacturing. Yubico shall have no liability for any error or damages of any kind resulting from the use of this document. The Yubico Software referenced in this document is licensed to you under the terms and conditions accompanying the software or as otherwise agreed between you or the company that you are representing. Contact Information Yubico Inc 420 Florence Street, Suite 200 Palo Alto, CA USA yubi.co/contact Document Release Date July 03, 2016yubico YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 2 of 24

3 Contents Copyright... 2 Trademarks... 2 Disclaimer... 2 Contact Information... 2 Document Release Date... 2 Introduction... 5 YubiKey for Salesforce... 5 Getting Additional Help... 6 Before you Begin... 7 Creating a Deployment Plan... 7 Organizing Users into User Licensees and Profiles... 8 Creating a Backup Account... 8 Testing YubiKeys for the Yubico Default Configuration... 8 Installing and Setting up YubiKey for Salesforce... 9 Installing YubiKey for Salesforce... 9 Setting up YubiKey for Salesforce Using YubiKey for Salesforce - For System Administrators Reviewing the Accounts of YubiKey Users Providing Support for Lost YubiKeys Tracking YubiKey Authentication Attempts Using YubiKey for Salesforce - For End Users Managing Assigned YubiKeys Deploying and Provisioning YubiKeys Manually Assigning YubiKeys Allowing Users to Register Their Own YubiKeys Removing Lost YubiKeys Understanding Sample Deployments Deployment Scenario Deployment Scenario Deployment Scenario YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 3 of 24

5 Introduction Yubico changes the game for strong authentication, providing superior security with unmatched ease-ofuse. Our core invention, the YubiKey, is a small USB and NFC device supporting multiple authentication and cryptographic protocols. With a simple touch, it protects access to computers, networks, and online services for the world s largest organizations. Our innovative keys offer strong authentication via Yubico one-time passwords (OTP), FIDO Universal 2nd Factor (U2F), and smart card (PIV, OpenPGP, OATH) all with a simple tap or touch of a button. YubiKeys protect access for everyone from individual home users to the world s largest organizations. YubiKey for Salesforce The audience for this document is administrators for the YubiKey for Salesforce application. You can easily secure your entire Salesforce deployment using YubiKeys and the YubiKey for Salesforce application. The YubiKey for Salesforce application takes advantage of the Login Flows architecture to enable the YubiKey as a second-factor authentication requirement for users. The YubiKey requirement can be applied to specific subsets of critical accounts, such as system administrators, or to everyone with an account, and modified as requirements change. The YubiKey for Salesforce application works with any YubiKey devices, in any number or combination. A single YubiKey can be purchased from Amazon or, for larger orders, directly from Yubico. Previously purchased YubiKeys, if they still have the default Yubico configuration, can be used with the YubiKey for Salesforce application. YubiKeys do not need to be registered with a Salesforce account before they are assigned to users, so you can distribute the YubiKeys as soon as they are received. This guide shows you how to configure YubiKeys to work with the YubiKey for Salesforce application and describes the following topics: Before You Begin Installing and Setting up YubiKey for SalesForce Using YubiKey for Salesforce - For System Administrators Using YubiKey for Salesforce - For End Users Deploying and Provisioning YubiKeys Removing Lost YubiKeys Understanding Sample Deployments Troubleshooting YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 5 of 24

6 Getting Additional Help For more information, and to get help with your YubiKeys, see: Support home page Documentation and FAQs Start a Support ticket YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 6 of 24

7 Before you Begin Before installing the YubiKey for Salesforce application, we recommend that you create a deployment plan that includes key requirements, verify users are organized into user Licensees and Profiles, create a backup account, and test the YubiKeys for the Yubico default configuration. IMPORTANT: You must be logged into a system administrator account to install the YubiKey for Salesforce application. In this Chapter Creating a Deployment Plan Organizing Users into User Licensees and Profiles Creating a Backup Account Testing YubiKeys for the Yubico Default Configuration Creating a Deployment Plan Be sure your deployment plan: Provides access to a system administrator account (you must be logged into a system administrator account when you install the YubiKey for Salesforce application). Lists the accounts that need to be secured. Decides whether users can self-register YubiKeys for their accounts. Specifies if users can self-register and, if so, the plan should specify a time limit for completing the registration and a notice when registration will be completed by administrators. Specifies how users are going to receive their YubiKeys. Specifies if YubiKeys are assigned to users by administrators, so planning should include processes to ensure the correct YubiKey is physically sent to the assigned user. Has a process for users to inform Salesforce administrators or the help desk if YubiKeys are lost. Defines a process for replacing lost YubiKeys. Includes a process for distributing temporary passcodes to users who cannot access their accounts due to lost YubiKeys. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 7 of 24

8 Organizing Users into User Licensees and Profiles Be sure your users are correctly organized into User Licensees and Profiles. Since enabling two-factor authentication for users is done according to a user s profiles group, we recommend that all users with the same security and access requirements are assigned to the same profiles group. Creating a Backup Account We recommend creating a secondary or backup account with access to the YubiKey for Salesforce Management tab. This protects your deployment if you lose your YubiKeys. To avoid being locked out of the Salesforce deployment in this scenario, create a backup account with a long, complex password as an emergency recovery option. Testing YubiKeys for the Yubico Default Configuration YubiKeys can be easily tested on the Yubico demo website to see if they are still configured with the Yubico default configuration. To test whether a YubiKey includes the Yubico default configuration 1. See the Yubico demonstration website, and click inside the YubiKey field. 2. Plug your YubiKey into a USB port of your computer, and when the green LED on the YubiKey lights, simply touch the gold button. The YubiKey sends the One-Time Password to the YubiKey field, and the demo server confirms whether it is valid. IMPORTANT: The identity listed must start with cc. If the identity instead begins with vv, this indicates that you have a user-registered token, and it will not be accepted. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 8 of 24

9 Installing and Setting up YubiKey for Salesforce This chapter describes how to download and install the YubiKey for Salesforce application. After you have installed the application, be sure you perform initial setup tasks for your users. In this Chapter Installing YubiKey for Salesforce Setting up YubiKey for Salesforce Installing YubiKey for Salesforce Follow the steps in this section to download and install the YubiKey for Salesforce application. IMPORTANT: The YubiKey for Salesforce application must be installed while you are logged into a system administrator account. To install the YubiKey for Salesforce application 1. Download the latest version of the YubiKey for Salesforce application from the Salesforce AppExchange website for the operating system you are using. 2. Log into a system administrator account (required). 3. On the first window, Package Installation Details, click Continue. 4. On the Third-Party Access window, the websites listed are part of the validation service for the YubiKeys. Select Yes, grant access, and then click Continue. 5. On the Step 1. Approve Package API Access window, the permissions are locked. Keep the default settings, and click Next. 6. On Step 2. Choose security level, set the level at which Salesforce users can access the tabs for the YubiKey for Salesforce settings. TIP: To allow users to self-manage their own YubiKeys and secondary authentication modes for their accounts, grant full access to all users. This option is essential for allowing users to process lost or replacement YubiKeys though the My YubiKeys tab. NOTE: Granting full access to all users does not allow non-system administrators access to the YubiKey Management tab. 7. Click Next to navigate to the next page. 8. On the Step 3. Install Package window, do one of the following: To return to the previous two installation windows and confirm or modify settings before installing the application: YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 9 of 24

10 a. Click Previous. b. After you finish modifying your settings, click Install to begin the installation process. To begin the installation without making changes to the previous windows, click Install. IMPORTANT: Do not navigate away from this window while the installation is in progress. The installation will take some time to complete. 9. On the YubiKey Management tab, accept the YubiKey for Salesforce Terms and Conditions. TIP: To access this tab, click + on the right side of the All Tabs menu at the top of the screen. 10. To associate user profiles with a service, select Setup > Administration Setup > Security Controls > Login Flows. 11. In the Login Flows action group, locate the Flows for User Interface Logins table, and click New. Repeat this step to create a new login flow for each user profile you want to secure with a YubiKey. 12. On the Login Flow Edit window, type a name for the login flow. We recommend using a descriptive name containing both the login flow provider and the profile you are connecting with that flow (for example, for a Standard Platform User, use YubiKey_Auth_StandP). 13. In the Flow field, select YubiKey_Login, and under the User License and Profile field, select the user license and profile that is to be protected with the YubiKey. 14. To save the connection, click Save or Save & New. IMPORTANT: Be sure to create a separate login flow for each profile protected with the YubiKey. If there is not a login flow for a user license or profile, users in that profile cannot be secured with a YubiKey. When you create login flows for all profiles that need YubiKey protection, you are finished with the setup of the YubiKey for Salesforce application. You can create new login flow connections for new profiles at any time. Setting up YubiKey for Salesforce This section describes the tasks you need to set up the YubiKey for Salesforce application for your users. The YubiKey Management tab is the central location for managing YubiKeys assigned to users within a Salesforce deployment. Once the YubiKey for Salesforce application is installed, users who have permission can access the application from the All Tabs menu. To access the All Tabs menu, click the + on the right side in the tabs bar at the top of the screen. The YubiKey Management tab includes two action groups Global Settings and User Management. NOTE: The first time you launch the YubiKey Management tab, you must accept the Yubico Terms and Conditions. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 10 of 24

11 To modify settings for YubiKeys across the entire Salesforce deployment 1. Launch the YubiKey for Salesforce application, and click the YubiKey Management tab. 2. In the Global Settings action group, to modify settings, click Edit, and do the following as needed for your deployment: To enable YubiKey authentication on the Salesforce application for profiles associated with a YubiKey Login Flow, select Enable YubiKey authentication. NOTE: Disabling this option also disables Allow self-provisioning and Bypass YubiKey authentication from a trusted IP options. To enable users to log in with only a user name and password, with the option to add a valid YubiKey by entering a One-Time Password from that YubiKey at each login attempt, select Allow self-provisioning. This option allows users in profiles associated with a YubiKey Login Flow to assign a YubiKey to their account when logging in with the YubiKey for the first time. NOTE: After a YubiKey is added to a user s account, it is required from that point forward. If this option is disabled, the user cannot log into the account without entering a One-Time Password with the YubiKey assigned to the account. To enable users to log in from a trusted IP address without using the YubiKeys assigned to the accounts, select Bypass YubiKey authentication when logging in from a trusted IP address. When enabled, the bypass option allows users logging in from a trusted IP address defined by Salesforce to authenticate without supplying a One-Time Password from a YubiKey associated with that account. NOTE: If Allow self-provisioning is enabled, at each login users are still prompted to assign a YubiKey to their account if they have not already done so. If Allow self-provisioning is disabled, users are always required to enter a One-Time Password from their YubiKey each time they log in. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 11 of 24

12 Using YubiKey for Salesforce - For System Administrators This chapter provides information for you to perform administrative tasks for your users, including reviewing the status of users with YubiKeys assigned to their accounts, providing support for lost YubiKeys, and tracking YubiKey login attempts. Perform these tasks using the User Management action group of the YubiKey Management tab. In this Chapter Reviewing the Accounts of YubiKey Users Providing Support for Lost YubiKeys Tracking YubiKey Authentication Attempts Reviewing the Accounts of YubiKey Users The User Management action group contains a table that lists all users in the Salesforce deployment. To review the status of users in the Salesforce deployment 1. Launch the YubiKey for Salesforce application, and click the YubiKey Management tab. 2. In the User Management action group, filter the users displayed by Profile, Number of YubiKeys, and Action: Profile Administrators can filter the users displayed by selecting the user profile in the profile field. Number of YubiKeys Users can be filtered by whether they have a YubiKey assigned to their account. This allows for administrators to easily identify accounts not protected with second-factor authentication. Action The Action column in the User Management table contains the possible YubiKey related actions administrators can take for the user. 3. To assign, remove, or edit YubiKeys and Salesforce Authenticator options assigned to a selected user, under Action, click Manage YubiKeys. For information about supporting users with lost YubiKeys, see the next section, Providing Support for Lost YubiKeys. Providing Support for Lost YubiKeys When users report lost YubiKeys, the Salesforce application locks the associated accounts (the accounts cannot be accessed). This section describes how to generate an emergency login code for users with lost YubiKeys. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 12 of 24

13 To allow temporary account access for a user with a lost YubiKey 1. Launch the YubiKey for Salesforce application, and click the YubiKey Management tab. 2. To locate the accounts for which you want to allow temporary access, in the User Management action group of the YubiKey Management tab, review the fields associated with each account: Name Displays the first and last name of each user. Username Displays the user name used to log into the Salesforce account of each user. Profile Displays the profile to which the user belongs. As YubiKey authentication must be applied separately to each profile, this field is useful in identifying those users who are secured and those who are not secured. 3. To generate a random 6-digit access code, which can be used in place of the YubiKey generated OTP, click Generate emergency login code for the user with the lost YubiKey. IMPORTANT: The emergency login code is valid for 45 minutes from the time the code is generated. Generating a new emergency login code immediately invalidates any previously generated emergency login code that has not expired. Tracking YubiKey Authentication Attempts This section describes how to track the data associated with YubiKey authentication attempts. This information is helpful in identifying accounts that may be targeted for attacks, which can present as repeated failures, reused OTPs, or invalid OTPs. IMPORTANT: Repeated login failures can be a sign of a directed attack against a Salesforce deployments account and should be met with the appropriate security and investigation response. To track the login attempts for a YubiKey 1. Launch the YubiKey for Salesforce application, and click the YubiKey Management tab. 2. In the upper right corner of the YubiKey Management tab, click the link to the YubiKey Authentication Log, which tracks all the login attempts with the YubiKey. 3. To navigate to the Log page, click Log. 4. Review the YubiKey Authentication Log to track login data, such as: User login attempts with the YubiKey into Salesforce (and the account used) Date and time of login attempts OTP used and the result of the login attempts The result of a login attempt can be any one of the following: OK the authentication was valid and the user logged in correctly. INVALID_OTP the authentication attempt was rejected because the OTP was not valid (either a fake or reused OTP). YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 13 of 24

14 OK_VALIDATED_AND_REGISTERED the authentication was valid and the user successfully registered the YubiKey to the account. YUBIKEY_ID_USER_MISMATCH the authentication attempt was rejected because the wrong YubiKey was used to log in. NONCE_MISMATCH the authentication with the YubiCloud validation service was rejected because the server did not return the correct Authentication Identification (Nonce). YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 14 of 24

15 Using YubiKey for Salesforce - For End Users The My YubiKeys tab allows for users to manage the YubiKeys assigned to their accounts. They can assign YubiKeys to their accounts or remove YubiKeys from their accounts, and register an authenticator app on a mobile device or tablet. NOTE: An administrator can also access the same function for each user using the Manage YubiKeys action in the YubiKey Management tab. Managing Assigned YubiKeys The YubiKeys assigned section of the My YubiKeys tab lists all the YubiKeys assigned to a user s account. Each YubiKey is identified by a serial number. You can add or remove YubiKeys and review the YubiKeys assigned to your account. To manage your assigned YubiKeys Launch the YubiKey for Salesforce application, click the My YubiKeys tab and then, in the YubiKeys assigned action group, do the following as needed: To assign a new YubiKey: i. Click Assign YubiKey to view a page on which you can manually assign a new YubiKey to your accounts. ii. Click inside the presented field, plug your YubiKey into a USB port of your computer, and touch the gold button on the YubiKey. TIP: If the YubiKey is valid for the Salesforce application, it will be immediately associated with the user s account. To remove a YubiKey, if your YubiKey is lost or stolen, click Remove. This disassociates the YubiKey from your account so that it can no longer be used to access the account. IMPORTANT: If all YubiKeys are removed from a user s account and Allow self-provisioning is enabled, anyone who has the user name and password for that account can register a new YubiKey. We recommend that you assign a new YubiKey to the account as soon as possible. To review the YubiKeys assigned to your accounts, compare the serial number for each YubiKey assigned to your account with the list of serial numbers here. TIP: The listed serial number for each YubiKey should match the serial number printed on the tab of the corresponding YubiKey. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 15 of 24

16 Setting Up an Authenticator App for Salesforce For situations where a YubiKey OTP will not work, such as mobile phones or tablets without NFC or USB support, you can use an authenticator app, such as Google or Salesforce Authenticator, in place of a YubiKey. Only one authenticator can be active per account at a time. To set up an authenticator app 1. Click Setup to start the process to register an authenticator app. NOTE: When you set up a new authenticator app, the previous authenticator setup no longer functions. 2. Select the device on which the authenticator is installed (Android, iphone / ipad, or Other). Once you select the device, the QR code for the device displays. 3. Scan the QR code with the authenticator app, then type or paste the provided code to register the authenticator app with the Salesforce account. If a valid code is not provided, the authenticator app will not be registered. TIP: Users can register a new authenticator app at any time. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 16 of 24

17 Deploying and Provisioning YubiKeys Once you are finished setting up the YubiKey management, you can distribute and assign YubiKeys to users. Once assigned, users can manage their YubiKeys using the My YubiKeys tab or administrators can do so for everyone in their organization on the YubiKey Management tab. There are two methods for assigning YubiKeys to users: You, the administrator, manually assign YubiKey to users or Allow users to register their own YubiKeys You can assign each YubiKey to multiple users in a Salesforce domain, and each user can have more than one YubiKey assigned. Manually Assigning YubiKeys If you manually assign YubiKeys to your users, users cannot log in until they have their assigned YubiKeys. Allowing Users to Register Their Own YubiKeys If you decide to use the Allow self-provisioning option, users are able to log in with only their user names and passwords until they associate the YubiKeys with their accounts. Each time users log in, a page displays prompting them to assign a YubiKey to their accounts. Users who do not have a YubiKey click Next to proceed to the next step. To assign a YubiKey to an account (for user self-provisioning) 1. Click inside the YubiKey field, and plug the YubiKey into a USB port of the computer. 2. Touch the button on the YubiKey for 1 to 2 seconds (or if a VIP YubiKey, for 3 to 5 seconds). This inserts a YubiKey One-Time Password into the YubiKey field. 3. To assign the YubiKey to the selected user, click Next. 4. Once the user assigns a YubiKey to an account, from that point forward, when logging in, the user must provide a One-Time Password using these same steps. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 17 of 24

18 Removing Lost YubiKeys When users lose YubiKeys or they are stolen, they should report the loss to an administrator as soon as possible or remove the lost YubiKeys themselves. Users or administrators can remove the YubiKey if it is lost. In this Chapter To remove a YubiKey To issue an emergency access code for locked out users To register a backup YubiKey (if the Allow self-provisioning option is enabled) To remove a YubiKey Access the YubiKey Management tab, and to remove the YubiKey from that user s account, click Remove. We recommend that you immediately register a new YubiKey for that account; if Allow self-provisioning is not enabled, the user will not be able to log in to their account once they log out. To provide an emergency access code for locked out users 1. Launch the Salesforce application. 2. In the Action window of the YubiKey Management tab, click Generate emergency login code. The application shows a window with the access code listed. This starts the 45-minute timer and invalidates any previously generated codes. 3. Due to the short timeframe during which the access code is valid, we recommend that you provide the code to your user over a real-time communications channel. To register a backup YubiKey (if Allow self-provisioning is enabled and the user has a backup YubiKey) In a situation where self-provisioning is enabled, and the user has a spare or backup YubiKey, users can register new YubiKeys the next time they log in, as long as no other YubiKeys are assigned to their accounts. When users log in with their user name and password, they are prompted to provide a One-Time Password from their YubiKey. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 18 of 24

19 Understanding Sample Deployments This chapter provides three deployment scenarios to help you understand the setup and details associated with deployments of different sizes and account settings. In this Chapter Deployment Scenario 1 (15 Users) Deployment Scenario 2 (50 Users) Deployment Scenario 3 (100 Users) Deployment Scenario 1 Setup An organization of 15 users wants to secure their user accounts with a YubiKey for Salesforce deployment. The Salesforce accounts all belong to 2-3 profiles, including a System Administrator Profile. The users are all physically located in the same office, within walking distance of the IT Administrator, all working during the same hours of the day. They have decided to allow user self-provisioning of YubiKeys, and that the employee s user name and password are sufficient for temporary access in the event a YubiKey is lost. YubiKey management is limited to system administrator accounts. All user profiles require a YubiKey for login. Allow self-provisioning is enabled. Each user is issued a primary and a backup YubiKey. Deployment YubiKeys are purchased by the company and stored in the office. The system administrator enables Allow self-provisioning and enables the YubiKey login. Users obtain YubiKeys from the office and associate the YubiKeys with their accounts. Handling Lost YubiKeys When YubiKeys are lost, users click the My YubiKeys tab to remove the lost YubiKey from their account, and the system administrator receives an . The user uses the backup YubiKey to log in to the account. The next time the user is in the office, the system administrator issues a new YubiKey that the user associates with the account. If the user will be out of the office for an extended period, the user can have an unregistered YubiKey shipped to their location, and then associate the new YubiKey with the account. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 19 of 24

20 Considerations While users who lose a YubiKey can log in with their user name and password, they should associate a new YubiKey with the account as soon as possible to prevent exploitation. Users can purchase a new YubiKey directly from Yubico (from the online store or Amazon) to associate with their account. Deployment Scenario 2 Setup A Salesforce deployment of 50 user accounts has added the YubiKey as a second-factor authentication to secure core user accounts. There are multiple account profiles (between 4 and 10), including the System Administrator, IT staff, and Salesforce Chatter access profiles. Most of the users work in the same location. Extended remote deployments are possible, and the users can spread their work hours over half the day. Security considerations require second-factor authentication when accessing the Salesforce application as they recognize that user name and password alone are not sufficient for authentication into their system. YubiKey management is set to System Administrator and IT staff accounts. Most user profiles require a YubiKey for login, with the exception of the limited access free accounts (Chatter, and so on). Allow self-provisioning is enabled upon deployment for a limited time, then turned off. Deployment YubiKeys are purchased by the company and stored in the office. The system administrator enables Allow self-provisioning and the YubiKey login requirement. Users obtain YubiKeys from the office and associate them with their accounts. Remote users have a YubiKey shipped to them directly. Users are instructed to enable the YubiKeys within a set amount of time, and lose access to Salesforce if they have failed to do so by the deadline. Handling Lost YubiKeys When YubiKeys are lost, IT staff is informed directly. The YubiKey is registered as lost, and the user is locked out of the account. The next time the user is in the office, IT staff issues a new YubiKey that has been manually registered to the account. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 20 of 24

21 Temporary emergency codes are issued only if the user cannot make it to the office. Considerations Before turning off Allow self-provisioning, administrators review those users who have not yet assigned a YubiKey to their accounts using the YubiKey Management tab and the User Settings table. To minimize downtime for remote users when their YubiKey is lost, a second, unassigned YubiKey can be provided to them. When remote users lose YubiKeys, they send the IT staff a One-Time Password generated by their second, unassigned YubiKey (this is done by clicking inside the body of an or text editor, plugging the YubiKey into a USB port, and pressing the gold contact on the YubiKey). The IT staff then copies and pastes this One- Time Password to register a new YubiKey for the user. Deployment Scenario 3 Setup A Salesforce deployment with over 100 user accounts is adding second-factor authentication with the YubiKey for all their user accounts. With over 10 distinct profiles for a range of different user account types, including system administrators, help desk employees, and IT staff, they are planning to stagger the deployment. Users are in various locations worldwide and must be supported 24 hours a day. The deployment of the YubiKey devices needs to be tracked, with records of which device is assigned to which user and, once enabled, users cannot log into Salesforce without their assigned YubiKey. YubiKey management is set to system administrator, IT staff accounts, and the help desk. User profiles use the YubiKey for workflow login in a staggered deployment, starting with the most critical users. Administrators completely set up the users in each profile with their YubiKeys before enabling the next set of users through login flows. Allow self-provisioning is not enabled. Deployment YubiKeys are purchased by the company and are shipped to office locations. The help desk and IT staff assign YubiKeys to users based on profile. Users do not need the YubiKeys to log in until the login flow for the profile their account belongs to is set. Remote users have a YubiKey shipped to them directly. When YubiKeys are physically deployed to users in the profile, the YubiKey Login Workflow for that profile is enabled and each user in that profile is required to use the YubiKey for authentication. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 21 of 24

22 The process repeats for each profile to be secured. The staggered deployment spreads out the load of provisioning and supporting the implementation of YubiKey for Salesforce login. Handling Lost YubiKeys When YubiKeys are lost, local help desk staff are informed directly. The YubiKey is registered as lost, and the user is locked out of the account. The next time the user is in the office, the IT staff issues a new YubiKey that has been manually registered to the account. For remote users who cannot visit an office, manually assigned replacement YubiKeys are shipped to the user directly. Temporary emergency codes are issued only if the user cannot make it to the office. Considerations When not using Allow self-provisioning, manually assigning YubiKeys to users requires a significant investment in IT work hours. While individual YubiKeys can be tracked using this method, it can place a large burden on smaller IT departments. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 22 of 24

23 Troubleshooting This chapter provides resolutions to issues when using YubiKeys with the Salesforce application. In this Chapter Issues and Resolutions Submitting a Technical Question Issues and Resolutions Issue: The YubiKey light does not blink. Resolution: Do the following, as needed, to resolve your issue: Check to see if the YubiKey is inserted correctly in the USB port. Insert the YubiKey into a different USB port. Verify the YubiKey works by inserting the YubiKey into a USB port on a different computer. If the YubiKey works on a different USB port or computer, the issue is most likely with the first USB port that you tried, and not with the YubiKey. Issue: The LED lights or flashes, but the YubiKey does not emit anything when I touch the gold contact. Resolution: Do the following, as needed, to resolve your issue: Make sure you are touching the gold contact for one to two seconds. Holding the contact for longer periods can cause the YubiKey not to emit anything. Test to see if your YubiKey works by inserting your YubiKey into a different USB port of your computer, and then inserting your YubiKey into a USB port of a different computer. NOTE: If the YubiKey behaves the same way across different computers and USB ports, the issue is most likely with the YubiKey, and it will need to be replaced. For more information, see the Yubico Support home page. Issue: The LED lights and the YubiKey emits nothing when I touch the gold contact. Resolution: Do the following, as needed, to resolve your issue: Make sure you are triggering the intended YubiKey configuration slot. To trigger Configuration Slot 1, touch the gold contact on the YubiKey button for one to two seconds; to trigger Configuration Slot 2, touch the gold contact on the YubiKey button for three to five seconds. Test the output at our demo server if the authentication fails, then the YubiKey is not valid for the YubiKey for Salesforce application. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 23 of 24

24 Be sure the One-Time Password generated by the YubiKey starts with cc. If the OTP starts with vv, this indicates a user-registered token and will not be accepted. NOTE: If the YubiKey is not configured correctly, the YubiKey must be replaced with a factory-configured YubiKey. Submitting a Technical Question Submit technical questions and issues to the Yubico Technical Forum. YubiKey for SalesForce Admin Guide 2016 Yubico. All rights reserved. Page 24 of 24