Identity Router
a month ago

Identity Router

An Identity Router® is software that enforces authentication and access for users of protected resources. See the following sections:

Deployment Components

The following deployment components communicate with the identity router.

ComponentPurpose
Cloud Access Service CAS

CAS enforces access policies, which determine which applications users can access, when additional authentication is needed, and which authentication methods are required. For example, a policy might allow only your sales team to access an application with sensitive customer information. Access policies are based on session information, such as IP addresses (for example, within a corporate network or not).

Identity sources

Identity routers connect to identity sources in real-time and synchronize a limited subset of user data to CAS. A minimum amount of user data is required to register authenticators. LDAP directory server user passwords are never synchronized and remain secure on your directory server.

Authentication Manager

AM enables users to authenticate with SecurID OTP credential or the RSAAuthenticator app from all access points controlled by AM.

Identity Router Platforms

To install the identity router, you use a virtual machine image, which includes all necessary identity router services. Your deployment may include multiple identity routers, which can operate in clusters to provide additional features and reliability. You can install the identity router on the following platforms:

PlatformDescriptionMore Information
VMwareThe identity router is typically installed as virtual appliance in a DMZ for your on-premises network using an Open Virtual Appliance (OVA) image for VMware.Install the Identity Router Virtual Appliance for VMware
Hyper-V

The identity router is typically installed as virtual appliance in a DMZ for your on-premises network using a Virtual Hard Disk (VHD) image for Microsoft Hyper-V.

Create the Identity Router Hyper-V Virtual Machine
Microsoft Azure The identity router is typically deployed as a virtual appliance in a DMZ within your cloud environment using a virtual hard disk (VHD) image in Microsoft Azure.Deploy an Identity Router Virtual Machine in Microsoft Azure
Amazon Web Services cloud

The identity router is installed as a virtual instance in a subnet in your Amazon Web Services cloud-computing environment using an Amazon Machine Image (AMI). There it can accept connections from the public Internet and act as a secure proxy for enabling remote access to applications that are not publicly accessible, such as Microsoft SharePoint or an on-premises web application.

Launch the Identity Router for Amazon Web Services
Authentication Manager 8.5 or later

The identity router is embedded in Authentication Manager 8.5 or later and can be optionally enabled by an administrator. This platform requires minimal configuration and can be used in place of or in addition to other identity routers. The embedded identity router does not support RADIUS or SSO.

Quick Setup - Connect Authentication Manager to Cloud Access Service with an Embedded Identity Router

The image file includes all services supported for the platform. Your deployment may include multiple identity routers, which operate in clusters to provide additional features and reliability.

In an IDR SSO Agent deployment, you can achieve high availability using a network load balancer to distribute workload among identity routers based on the available capacity. For more information, see Configure High Availability for Cloud Access Service Deployments.

Identity Router Services

An identity router contains the following services.

Note:  RADIUS and IDR SSO Agent services are supported for all platforms except for the embedded identity router in AM.

Service

Description

Enterprise Connector

  • Connects CAS to enterprise resources such as LDAP directory servers and Authentication Manager.

  • Connects users to CAS to provide additional authentication credentials when required.

RADIUS

Hosts a RADIUS server that, when enabled, provides RSA authentication for VPN servers and other RADIUS-capable client devices.

IDR SSO Agent

  • Hosts the application portal, which provides a convenient interface where users can view and access protected applications.

  • Authenticates users to the application portal and tracks sign-in sessions for protected applications.

  • Manages sign-in session duration for HTTP Federation (HFED) and trusted header applications, and the application portal.

  • Manages SSO for applications that support Security Assertion Markup Language (SAML), as well as non-SAML applications. Users who satisfy the authentication requirements to access one application are not required to re-enter the same authentication credentials to access a second application that uses the same or lower assurance level during the same SSO session.

  • Provides HFED to enable SSO for non-SAML applications.

  • Extends Integrated Windows Authentication and LDAP directory server user password SSO functionality to protected applications.

  • Supports SAML "just-in-time" user provisioning, allowing compatible applications to create new user accounts based on extended attributes contained in SAML assertions.

The RADIUS and IDR SSO Agent services can be enabled or disabled. The Enterprise Connector service is always enabled.

For information on protecting the identity router environment, see RSA CAS Security Configuration Guide.

Related Tasks

Deploying an Identity Router - Advanced Setup

View Identity Router Status in the Cloud Administration Console

Reference Materials

Manage Identity Routers in the Cloud Administration Console

Identity Router DNS Requirements

Identity Router Virtual Appliance Hardware and Software Requirements for On-Premises Deployments

Identity Router Network Interfaces and Default Ports

Don't see what you're looking for?