Royal Apps

Hello Team,

I am designing solution for my company and would like to use Credentials but only from lastpass. In other words: because of security reasons i do not want any user to configure their own local Credentials (and store them on laptop - even encrypted/protected).

Because of the same reason i need to make sure provided Lastpass credentials are never saved to disk (even encrypted). It should stay in memory only.

Possible ?

Thanks,

Michal

Hi there, I'm looking for such a solution for our company, we don't want that users are able to save passwords locally. For security reasons, we want all passwords saved on LastPass and require users to retype LastPass password (global for all users sharing RoyalTS connections) everytime RoyalTS is launched. I expected a direct and synchronized link between RoyalTS et LastPass, RoyalTS has to get credentials directly from LastPass when a connection is started. Felix mention ''LastPass credentials are never saved to disk and always only available in memory while the app is running and a LastPass vault is opened'' but I didn't find how to link RoyalTS directly with LastPass vault. Under Data->LastPass Vaults, it will import LastPass credentials once but it's not dynamically updated (a change on LastPass will not update RoyalTS) and credentials are then stored in the RoyalTS document (locally), allowing each user to save the document and keep the credentials locally. Am I doing something wrong? Is there such a solution? Thanks for your inputs. Mario

Hi Felix, let's try to explain our use case. We already use RoyalTS with a shared document. For security reasons, I'm looking for a central solution to save passwords outside RoyalTS (LastPass). The goal is, when a employee leaves our company, we must ensure that even if he saves a local copy of RoyalTS document, he will not be able to connect to remote servers. I'm expecting RoyalTS doesn't saves any information from LastPass locally and requires LastPass password at every launch. That way, if an administrator changes the LastPass password, the user (who leaved the company) will not be able to access the credentials.

As I could test till now, when I add a LastPass vault in RoyalTS, it will download the credentials into the opened RTS document. If I close RTS / document and open it again, it doesn't asks for the LastPass pwd and the credentials folder is still there accessible. I expected by closing RTS, the credentials are not kept into the document and it require to enter the LastPass pwd at every opening.

I hope it's more clear. Thanks for your help

Hey Felix, i have exactly same use case as Mario, would be great to have a solution here. Thanks !

Could not we just make sure that:

- RoyalTSX will never save (or allow to save) LastPass password (keep it memory only)

- RoyalTSX will never save (or allow to save) any password from LastPass vault (keep it in memory only) ?

Hi Felix, 

Thanks for the confirmation - compliance reasons. 

My company/organization have to go via strict audits. I would need to prove that RoyalTSX does not store any passwords. If it stores any kind of password RoyalTSX would have to be deeply audited (which is time consuming/costly). So looking for a deployment which would give me that guarantee, that nobody is able to export any password out of RoyalTSX. Having those staying in memory only would be good enough (block an option to save it to file/disk). 

Does it make sense ?

Thanks,

Hi Felix, 

I got your point. It makes sense. But it's all about execution. Once we terminate contract with employee LastPass account is blocked and it's not possible to retrieve credentials from there anymore. But if those credentials are stored in RoyalTSX or any other Connection Managers - which might be used on contractors computers/private PCs over which we might not have a control - then we have the issue (those credentials are still easily accessible).

It's also about security policy (we might change it in the future) saying it's safer to store credentials in one centralised Vault (with visibility/auditing) versus locally on thousands of PCs (sometimes well encrypted/sometimes not -> would have to audit it).

Again: you are right, somebody with active LastPass account could export all the passwords and store them in plaintext on desktop. On the other side we want to eliminate all places where we store passwords permanently and audit very carefully those plus maybe even have enforcement of those policies in the future.

This is a bit similar to x509 certificate - if i want to mark it as non-exportable it should be non-exportable (unfortunately it's not always the case).

Thanks,

Michal

ok, thanks for super fast answer Felix !