Emergency Access for RSA Authentication Manager Users

Document created by RSA Information Design and Development Employee on Jun 13, 2017Last modified by RSA Link Admin on Sep 18, 2020
Version 16Show Document
  • View in full screen mode

You can provide online or offline emergency access to resources protected by RSA Authentication Manager in the following situations.

                   
User Situation Requiring Emergency AccessAvailable Methods
  • The user's RSA SecurID Token or RSA SecurID Authenticate app is unavailable.

  • The user's device can reach the Authentication Manager server over the network.

Temporary fixed tokencode

One-time tokencode

See Tokencodes for Online Emergency Access.

  • The user's RSA SecurID Token or Authenticate app is unavailable.

  • The user forgot his or her RSA SecurID PIN.

  • The user's Windows device cannot reach the Authentication Manager server through the network.

Offline emergency access tokencode

Offline emergency access passcode

See Tokencodes for Offline Emergency Access .

Note:   These emergency access methods cannot be used to access resources protected by the Cloud Authentication Service.

Tokencodes for Online Emergency Access

There are two types of online emergency access tokencodes. Each tokencode is an 8-character alphanumeric code generated by Authentication Manager. The user's device must be able to reach Authentication Manager on the network.

Users must have been assigned a valid, unexpired RSA SecurID Token before they receive an online emergency access tokencode. If a user's token has expired, first assign a new token and then provide temporary access.

                   
Tokencode TypeDescription
Temporary fixed tokencode
  • Can be used more than once.

  • When the user's RSA SecurID Token is unavailable, the user must enter this tokencode with the RSA SecurID PIN. When the Authenticate app is unavailable, the user enters only the temporary fixed tokencode. A PIN might be required to view the tokencode on the mobile device, but this is not the RSA SecurID PIN.

  • You configure the expiration date or no expiration.

  • Is displayed on the Self-Service Console.

For instructions, see Assign a Temporary Fixed Tokencode.

One-time tokencode
  • Issued in sets.

  • You can determine the number of tokencodes in a set.

  • RSA SecurID users must enter this tokencode with the RSA SecurID PIN to perform two-factor authentication. Authenticate app users enter this tokencode without a PIN. A PIN might be required to view the tokencode on the mobile device, but this is not the RSA SecurID PIN.

  • Is displayed on the Self-Service Console.

  • Users can download the set of one-time tokencodes in a file.

  • Each tokencode in the set can only be used once.

For instructions, see Assign a Set of One-Time Tokencodes.

Users can also use the Self-Service Console to request temporary access to Authentication Manager without the assistance of an administrator. For more information, see RSA Self-Service Overview.

Online Emergency Access Tokencode Format

When online emergency access is used because the user's RSA SecurID token is unavailable, the token policy of the associated security domain determines the format of the online emergency access tokencode. For example, if the security domain’s token policy allows special characters, the online emergency access tokencode can include special characters.

This token policy is not considered when the online emergency access method is used in place of the Authenticate app.

Tokencodes for Offline Emergency Access

Offline emergency access is intended for when the user cannot access the Authentication Manager server on the network. You must provide the emergency offline authentication codes in advance, when the user has online connectivity. The system generates and downloads an offline passcode or tokencode to the user's Windows device before the user needs it. These codes cannot be sent to a user who is offline.

Note:  These methods cannot be used in place of the Authenticate app.

                   
Tokencode TypeDescription
Offline emergency access tokencode
  • Used when the user's RSA SecurID token or RSA SecurID Authenticate app is unavailable.

  • RSA SecurID users must enter the offline emergency access tokencode with the RSA SecurID PIN to perform two-factor authentication.

  • Can be used for online or offline authentication.

    For instructions, see Provide an Offline Emergency Access Tokencode

Offline emergency passcode

 

 

 

 

 

You are here
Table of Contents > Emergency Access > Emergency Access for Authentication Manager Users

Attachments

    Outcomes