You must enable synchronization for identity source attributes if you want users to authenticate through the Cloud Authentication Service. For details, see:
Note: SMS Tokencode Phone Number, Voice Tokencode Phone Number, and Alternate Username are synchronized if you configure them when you add an identity source. This applies to both Active Directory and LDAPv3 directory servers.
When you add an Active Directory identity source, the attributes in the following table are mapped to their corresponding attributes in Active Directory. The table shows the default mapping, but you can customize the mapping.
If you want Active Directory users to authenticate through the Cloud Authentication Service, you must enable synchronization for these attributes. See Where to Enable Attribute Synchronization for more information.
|Field Name in the Cloud Administration Console||Attribute Name in Active Directory||Usage|
|First Name||givenName||User's first name|
|Last Name||sn||User's last name|
|Email Address||User's email address/User ID|
|SecurID Username||sAMAccountName||User ID for RADIUS and RSA SecurID authentication.|
|Primary Unique Identifier||distinguishedName||Used during device registration, LDAP password authentication (including primary authentication for relying parties and RADIUS), FIDO registration, and identity source synchronization.|
|Secondary Unique Identifier||objectGUID||Used to identify users during synchronization.|
|User Account Status||userAccountControl||Indicates whether a user is enabled or disabled in Active Directory. A disabled user cannot authenticate using the Cloud Authentication Service.|
|User Account Expiration||accountExpires|| |
Indicates when the user’s Active Directory account expires, if applicable. An expired user is disabled in the Cloud Authentication Service and cannot authenticate.
Note: If you are synchronizing from an Active Directory Global Catalog, RSA recommends that, in the directory server, you configure accountExpires to be replicated to the Active Directory Global Catalog. This ensures that user enablement status in the Cloud Authentication Service is synchronized with Active Directory.
If you want LDAPv3 users to authenticate through the Cloud Authentication Service, you must do the following when you add an identity source:
Map each of the following user attributes to its corresponding attribute in your LDAPv3 directory server.
Enable synchronization for these attributes. See Where to Enable Attribute Synchronization for more information.
|Cloud Authentication Service Attribute Name||Attribute Value||Name of Recommended Attribute in LDAPv3 Directory Server|
|Oracle Directory Server||Apache Directory Server||OpenDJ||OpenLDAP|
|First Name||User's first name.||givenName||givenName||givenName||givenName|
|Last Name||User's last name.||sn||sn||sn||sn|
|Email Address|| |
User's email address.
Note: This attribute must be named mail and must be in the LDAP directory's inetOrgPerson objectClass.
|SecurID Username|| |
User's SecurID username. Typically, this is a short username, such as jdoe.
If your deployment does not include RSA Authentication Manager, set this attribute to the same value as the Primary Unique Identifier.
|Primary Unique Identifier||A unique identifying value (DN) for the user.||entryDN||entryDN||entryDN||entrydn|
|Secondary Unique Identifier||A unique and stable identifier for the user. The value of the Secondary Unique Identifier must not change, even if the user's name, email address, or DN changes over time.||nsUniqueId||entryUUID||entryUUID||nsUniqueId|
|User Account Status|| |
Indicates whether a user is enabled or disabled in the directory server. A disabled user cannot authenticate using the Cloud Authentication Service.
If you cannot use a recommended attribute, map to a similar boolean attribute. The Cloud Authentication Service treats the TRUE value as disabled status and FALSE value as enabled status.
|User Account Expiration||Indicates when the user’s directory server account expires, if applicable. An expired user is disabled in the Cloud Authentication Service and cannot authenticate. Also see User Account Expiration Attributes for LDAPv3 Directory Servers.||N/A||N/A||ds-pwp-account-expiration-time attribute.||N/A|
If your directory server tracks expired user accounts through an LDAP attribute, you can map User Account Expiration to any attribute that accepts a value in LDAP GeneralizedTime type format, as described in https://tools.ietf.org/html/rfc4517#page-13. The time reflects the user's account end date. If detection is unsupported, leave this attribute blank. If you do not map this attribute or the value is blank, the Cloud Authentication Service assumes the account is not expired.
You enable attribute synchronization when you add an identity source on the Users > Identity Source wizard pages.
|If you want to do this...||You must select...|
|Allow users to use the Cloud Authentication Service|| |
Synchronize user attributes on the Synchronize User Attributes page. These attributes are used to validate user authentication requests and register devices. Synchronization is required for RADIUS and relying party deployments.
For SSO Agent deployments, synchronization is required if at least one application is protected by a policy that requires additional authentication. If only password authentication is used, you do not need to synchronize.
Synchronization is also required if you configured the application portal or the Cloud Administration Console to require additional authentication.
Set up access policy rules to identify the target population based on user attributes for non-SSO Agent use cases.
Synchronize the selected policy attributes with the Cloud Authentication Service on the User Attributes page, and also select which attributes you want to synchronize. Selecting this option automatically enables the Synchronize user attributes checkbox to synchronize the authentication attributes listed in the previous table.
Note: In SSO Agent deployments, access policies are evaluated on the identity router, so you do not need to select attributes on the User Attributes page for synchronization.
We want your feedback! Tell us what you think of this page.