000013846 - BlackBerry 10 1.x Invalid device binding. Token import failed. Contact your administrator

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000013846
Applies ToBlackberry 10 1.x, Q10, Z10 Device Identifying Information
One other thing that can cause the RSA Tokens to not import with this failed to Bind error is that the BB10 Z10 OS has more than one workspace, one for corporate work, another for personal.  The RSA Token Application must be installed in the same workspace as the email application for import to work.
Device Class Binding:
By default, software tokens intended for BlackBerry 10 devices are bound to the BlackBerry 10 1.x device class GUID (globally unique identifier). This option allows the user to import the token to any BlackBerry 10 device that is supported by the RSA SecurID app. It prevents the token from being imported to other types of mobile devices or to desktops or laptops running an RSA SecurID software token app.

The BlackBerry 10 1.x device class GUID is b77a1d06-d505-4200-90d3-1bb397748704
Jira SFB-142 bug - Product Manager:15-Nov-2013 12:41 PM

Device Identifying Information needs to be turned on, regardless of whether or not the Token Record file uses device binding... This is Functions as Designed.

IssueSuccessfully import RSA SecurID software token into a Blackberry Z10
Customer Support Training module, CSTM on Software Tokens and other topics: Copy and paste this link into your browser URL
Error: Invalid device binding.  Token import failed. Contact your administrator  [OK] when trying to import Device Type BB10 software token in BlackBerry 10 with RSA software token application version 1.0, 1.x.  This occurs even when Device ID, DeviceSerialNumber: is blank during RSA software token distribution.
Invalid device binding.  Token import failed. Contact your administrator.
If software token distributed as BB3 or AES Generic it will import
CauseBlackBerry 10?s have two Device IDs, one individual Device ID and one Global Device Class.  The Global Device ID is the same for all BB 10 phones, and if you use the RSA Software Token Device Type for BB10, you are automatically binding to this global Device ID.  When you install the RSA software token application on a BlackBerry, there is a question/checkbox called ?Device Identifying Information? and if this is unchecked, you do not use the Global Device ID, therefore a Software Token for BB10 Device type will not import with the invaldi device binding error.  The RSA Soft Token Device Type of BB3, or even AES Generic, does not check for this GUID Device ID, so it will import
ResolutionIf you can access
If the RSA Token App is in a different workspace from the email application, you will need to Re-install the RSA BB10 1.x software token application again, in the same workspace as email runs in and with Device Identifying Information checked, which you can configure after installation if not prompted.
Optionally try using another Device Type that does not check for the GUID Device ID

NotesHere comes the question: why a user could not modify the app permission setting without a complete security wipe? Is this your app issue or Blackberry work space issue?

I saw a user already complained about this same issue on Blackberry World.  This issue can be re-produced and your support / development team needs to address it and provide a solution ASAP. Remember that most users cannot afford to wipe out everything on the device to just have this app installed correctly.

 <screen shot>

*     surbaniak-84708

RSA SecurID Token App review "Something was not well thought out in the install process. 1st install gave the app wrong access permissions (specifically no access to deviceID).  Uninstalled.  Now all subsequent reinstall attempts no longer ask me to select app permissions - so it is stuck in limbo unable to import token (no deviceID visible to app).  RSA app not listed in app-permission screen either, so can't fix it there.

Sent: Wednesday, November 13, 2013 12:49 PM

To: Guillette, Jay

Subject: RE: Emailing: BB10.sdtid


I figured it out why my RSA token import always failed. Hope it can help you and your support team members dealing with the same issue.

When the first time I installed the RSA SecurID app in my work space, I was presented with the following screen during the app installation:

 <screen shot>

RSA SecurID 

Device Identifying Information [ ]


I unchecked both options as I thought I could modify the security settings anytime later in Security page as stated on the screen:

 <screen shot> RSA SecurID App install

"You can visit the Security page in the System Settings to change your permissions at any time"


However, when I went back to Application Permissions page after the app was installed, the App was missing and I had no way to modify the security setting for the app!!!

 <screen shot>

Security and Privacy

Application Permissions

 <screen shot>

APP Permissions All

[ ] Maps

If you check the info on the app, you can find the DeviceID is blank.

 <screen shot>

 RSA App DeviceID blank

All efforts for importing a token file failed as no device ID information can be found from the device.

I deleted my work space and re-installed the app. The app was installed but it never showed up the page for you to set up app security. 

I did not want a security wipe on my z10 because I have some data in my personal space. Luckily I have another Z10 device I can play with. I wiped out the second z10, activated it and installed the App. This time I made sure that both options were checked.


Once installation is done, I can verify that the DeviceID is shown up on the App info page:

 <screen shot>

SecurID APP with DeviceID included

And a  token file import was completed successful

Legacy Article IDa62984