An Identity Router is software that enforces authentication and access for users of protected resources. See the following sections:
The following deployment components communicate with the identity router.
|Cloud Authentication Service|| |
The Cloud Authentication Service enforces access policies, which determine which applications users can access, when additional authentication is needed, and which authentication methods are required. For example, a policy might allow only your sales team to access an application with sensitive customer information. Access policies are based on session information, such as IP addresses (for example, within a corporate network or not).
|Identity sources|| |
Identity routers connect to identity sources in real-time and synchronize a limited subset of user data to the Cloud Authentication Service. A minimum amount of user data is required to register authenticators. LDAP directory server user passwords are never synchronized and remain secure on your directory server.
|RSA Authentication Manager|| |
Authentication Manager enables users to authenticate with RSA SecurID tokens or the RSA SecurID Authenticate app from all access points controlled by Authentication Manager.
To install the identity router, you use a virtual machine image, which includes all necessary identity router services. Your deployment may include multiple identity routers, which can operate in clusters to provide additional features and reliability. You can install the identity router on the following platforms:
|VMware||The identity router is typically installed as virtual appliance in a DMZ for your on-premises network using an Open Virtual Appliance (OVA) image for VMware.||Install the Identity Router Virtual Appliance for VMware|
The identity router is typically installed as virtual appliance in a DMZ for your on-premises network using a Virtual Hard Disk (VHD) image for Microsoft Hyper-V.
|Create the Identity Router Hyper-V Virtual Machine|
|Amazon Web Services cloud|| |
The identity router is installed as a virtual instance in a subnet in your Amazon Web Services cloud-computing environment using an Amazon Machine Image (AMI). There it can accept connections from the public Internet and act as a secure proxy for enabling remote access to applications that are not publicly accessible, such as Microsoft SharePoint or an on-premises web application.
|Launch the Identity Router for Amazon Web Services|
|RSA Authentication Manager 8.5 or later|| |
The identity router is embedded in RSA Authentication Manager 8.5 or later and can be optionally enabled by an administrator. This platform requires minimal configuration and can be used in place of or in addition to other identity routers. The embedded identity router does not support RADIUS or SSO.
|Quick Setup - Connect RSA Authentication Manager to the Cloud Authentication Service with an Embedded Identity Router|
The image file includes all services supported for the platform. Your deployment may include multiple identity routers, which operate in clusters to provide additional features and reliability.
In an SSO Agent deployment, you can achieve high availability using a network load balancer to distribute workload among identity routers based on the available capacity. For more information, see Configure High Availability for Cloud Administration Console Deployments.
An identity router contains the following services.
Note: RADIUS and SSO Agent services are supported for all platforms except for the embedded identity router in Authentication Manager.
Hosts a RADIUS server that, when enabled, provides RSA SecurID Access authentication for VPN servers and other RADIUS-capable client devices.
The RADIUS and SSO Agent services can be enabled or disabled. The Enterprise Connector service is always enabled.
For information on protecting the identity router environment, see the RSA SecurID Access Cloud Authentication Service Security Configuration Guide.