# Yubikey validation to get admin rights inside application

**URL:** <https://forum.inductiveautomation.com/t/yubikey-validation-to-get-admin-rights-inside-application/68126>\
**Category:** Ignition\
**Tags:** vision\
**Created:** [January 2, 2023, 2:31pm UTC](https://forum.inductiveautomation.com/t/yubikey-validation-to-get-admin-rights-inside-application/68126 "2023-01-02T14:31:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anna.forsberg](https://avatars.discourse-cdn.com/v4/letter/a/8e7dd6/32.png) [@anna.forsberg](https://forum.inductiveautomation.com/u/anna.forsberg)\
**Post date:** [January 2, 2023, 2:31pm UTC](https://forum.inductiveautomation.com/t/yubikey-validation-to-get-admin-rights-inside-application/68126/1 "2023-01-02T14:31:50Z")

</div>

Hi,  
We have some ignition vision applications where we use SSO to log in , this is done with accounts based on the machine, so the machine account is the windows user. Now we need to add some admin functionalities that should be based on a user logging in inside of the application.  
The problem is that the operators only have Yubikeys, no account or password, is there any support for yubikey validation in ignition or do you have any suggestion on how to solve this?

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [January 2, 2023, 3:16pm UTC](https://forum.inductiveautomation.com/t/yubikey-validation-to-get-admin-rights-inside-application/68126/2 "2023-01-02T15:16:34Z")

</div>

Vision can call external applications and scripts (using [ProcessBuilder](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/lang/ProcessBuilder.html) if you want to return results), so first try to get an external validation to work. If you don't already have an executable that will interrogate the yubikey for you, you probably should start here:

[https://developers.yubico.com/OTP/](https://developers.yubico.com/OTP/)

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [January 2, 2023, 3:24pm UTC](https://forum.inductiveautomation.com/t/yubikey-validation-to-get-admin-rights-inside-application/68126/3 "2023-01-02T15:24:58Z")

</div>

I thought this was helpful, though it sounds like you are a Windows shop:

[https://wiki.archlinux.org/title/YubiKey](https://wiki.archlinux.org/title/YubiKey)

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [January 2, 2023, 3:27pm UTC](https://forum.inductiveautomation.com/t/yubikey-validation-to-get-admin-rights-inside-application/68126/4 "2023-01-02T15:27:20Z")

</div>

Also found this:

> **[One api.yubico.com; One HTTP GET](https://status.yubico.com/2021/04/15/one-api-yubico-com-one-http-get/)**
>
> A year ago, we moved all YubiOTP validation API servers behind one common api.yubico.com endpoint, introducing a modernized, cloud-based, YubiOTP validation service to improve reliability and scala…