MFA requires browser update when connecting Designer to Private Gallery

[LanceFace]

Have a question I can't figure out... and finally something I haven't seen posted on community before.

I'm trying to connect Designer to our on-prem Server to save/open workflows. We are authenticating through SSO (Okta and DUO). When I get to the 2 factor authentication step, DUO is checking the browser version before it allows me to enter a code or push a request to my phone -- and it always says that the browser version is over 8 months out of date. I am currently using Alteryx v2021.3.3.63061.

I have tried a few things and they did not work:

• Updated chrome (it is up to date)
• Uninstall/Reinstall Chrome
• Set IE as default
• Set Edge as default
• Uninstall/Reinstall Alteryx (I'm using Version: 2021.3.3.63061)
• Turn off company VPN halfway through log-in (our IT said sometimes that messes with it)

The one thing that I tried that did yield different results was that I installed Alteryx v2021.1.6.53528 and tried again and it said the browser was even more out of date.

Wondering if someone else has encountered it and if there is a work-around/fix (maybe a way to force launch the external browser for authentication?).

All ideas welcome!

Lance

[apathetichell]

Hey @KenL - we can talk about this off channel if you want - but that's kind of moot. Customers (especially those in more tech heavy spaces) expect control of the browser at an enterprise level. This is an issue which Alteryx will not be able to keep up with and has been flagged for years at this point. 

My company doesn't have Server. We talk about getting Server once every few months - in the back of my head I always think - the chrome issue will be a battle. Do I need to battle with my IT department to try to justify this?

@tcheng  - I recommend using the Server API to manage the interaction between server and designer if you do not think you can get a security one-off policy for traffic originating from or going to your Alteryx Server.  I'd also recommend hosting your Server inside of your VPN if you do not already  - to try to appease InfoSec/CloudSec/CorpSec - whoever controls those kinds of things.

[tcheng]

Thanks for the suggestion. I already opened an internal ticket to check and see if the issue with SSO might really be related to unsupported internal browser version within Alteryx. 

Where can I find more info on using server API to manage interaction between designer and server?

[apathetichell]

Download the pack from here - https://community.alteryx.com/t5/Engine-Works/Introducing-the-Alteryx-Server-v3-API/ba-p/899228

[tcheng]

What's the embedded Chrome browser version number for Alteryx Designer 2022.3?

[KenL]

@apathetichell @tcheng 

As the login window to Server in Designer is using the Chromium Embedded Framework, the Chrome version used will be static for each Designer version. We do upgrade the Chrome version used in newer versions of Designer. You can submit a product idea or reach out to your Alteryx Account Executive about proposed changes to the current product design.

To determine what version of Chrome is used in the Chromium Embedded Framework, you can do the following:

1. Enable to HTML Developer Tools in Designer, as described in this Help documentation: https://help.alteryx.com/current/en/developer-help/platform-sdk/legacy-sdks/html-gui-sdk/html-develo...
2. Go back to Designer and login to Server. The Alteryx HTML Developer Tools window will appear
3. In Alteryx HTML Developer Tools, go to Network and click on the rows captured to see the Chrome version in the Headers tab

[apathetichell]

@KenL - yup 100% sure there are tickets relating to this. I've been on numerous calls - and a miscommunication of the underlying issue was a primary feature of 2021.3 (which had the first Chromium update in a while - and yes I mean 2021.3).

Personally - I don't think changing the internal browser to an external browser is the right fix anymore.  I'd do away with the browser connection entirely. To me - the right fix is to have code going to Server instead sync with a repo (ie github) and have the repo (ie github) push the new packages to either an S3 which Server pulls from or directly to Server.