OTP Protection

[reginfo]

Hi,
I would like to ask about a feature related to OTP handling.
Is it possible to restrict visibility of the OTP secret key so that it is visible only to a specific user or group, while the OTP code itself remains visible to all users who have access to the item?
Currently, any user with access to the item can view the OTP secret key and enroll it on their own phone or PC to generate OTP codes.
This creates a potential security risk, especially in scenarios with high user rotation (for example, helpdesk users). If a user leaves the company and the security team does not rotate the OTP secret in time — or if the OTP belongs to a third‑party system where obtaining a new secret is more complex — this could lead to unauthorized continued access.

[guerricv]

Hello,
I think you can do that adjusting roles and folder permissions :
=> setup one folder or subfolder : managers can edit items in that folders and users can only read. It would block edition capability and then block access to the OTP secret key.
I'm going to think about another smart way to do that, but I'm afraid to do something to complex to maintain.

[reginfo]

Thank you @guerricv.
I tried your suggestion, but I don't found how to accomplish it.

[guerricv]

You should be able to define 2 roles :

• one with read and write access to items in a specific folder : IT managers for example - can edit, add, or delete items.
• another one with only with Read access to the same folder : for Helpdesk users for example who can only read and use items

That solution works on my side - It is place on my side for a folder where managers can edit / update / add items and users can only read / use items contained in that folder.
Basically that is the same strategy we can use on file servers or others systems with NTFS rights for example or others files sytem.