This article describes how to integrate idGenius with RSA Cloud Access Service (CAS) using the REST Administration API for enrollment.

Configure CAS

Perform these steps to configure CAS.

Procedure

1. Sign in to the RSA Cloud Administration Console. Go to Platform > API Access Management.
   This page shows the REST base URLs and the OAuth clients. Make a note of the Administration API REST URL. 
   
   Figure 1. RSA API Access Management — REST base URLs and the OAuth clients, including the Admin API client used for enrollment.
      
2. Create an Admin API client (Add API Client > Client Type = Admin API), or open an existing one via OAuth Clients > (client) > ⋮ > Edit. The wizard has three steps: Basic Information, Authentication, and Permissions.
3. Authentication: confirm Grant Type = Client Credentials and Client Authentication = Private Key JWT. Generate a key pair (or paste your own public key), replace the Public Key field with the new public JWK, and save the private JWK locally for idGenius. Make a note of the Issuer URL and Client ID.
   
   Figure 2. RSA Admin API OAuth client — Authentication step: Issuer URL, Client ID, Grant Type = Client Credentials, Client Authentication = Private Key JWT, and the public key.
      
4. Permissions: grant the User permission group, which includes the required rsa.user.manage permission (with rsa.user.read, rsa.user.sync, rsa.user.factor.manage, etc.).
5. Click Save and Finish.
   
   

   Figure 3. RSA Admin API OAuth client — Permissions: the User group grants rsa.user.manage and related scopes.
     

6. Click Publish Changes.
   The status returns to Success with “Administration API Client updated successfully.”
   
   

   Figure 4. RSA — changes published; the Admin API client update is live.
     

7. Collect the following values. Tenant-specific identifiers are shown as placeholders.
   

   Field	Value
   Admin API URL	https://<rsa-tenant>.access.securid.com/AdminInterface/restapi
   OAuth Issuer URL	https://<rsa-tenant>.auth.securid.com/oauth
   OAuth Token Endpoint (derived)	https://<rsa-tenant>.auth.securid.com/oauth/token
   OAuth Client ID	Generated by RSA for the Admin API client (<admin-oauth-client-id>)
   OAuth Scopes	rsa.user.manage
   Client Authentication	Private Key JWT (RS256)
   Grant Type	Client Credentials
   Code Delivery	EMAIL — RSA emails the user (recommended)
   Code Validity	60 minutes (configurable 10 minutes – 24 hours)

        
   Note: As with the SCIM API client, RSA stores only the public half of the Admin API client’s signing key; idGenius holds the private JWK (encrypted at rest, never returned by the API). Because RSA never reveals an existing client’s private key, generate a fresh key pair, register the public JWK on the RSA client, and store the private JWK in idGenius.

Configure idGenius

Perform these steps to configure idGenius.

Procedure

1. Sign in to idGenius (https://<idgenius-tenant>.idgenius.io/) and go to Settings > Administration > SCIM > Outbound.
2. On the RSA ID Plus provider row, click Edit (pencil) to open Edit Outbound Provider, then scroll to the RSA SecurID Enrollment section. The enable toggle stays disabled until all required enrollment fields are filled.
3. Fill the enrollment fields with the captured values from RSA:
   • Admin API URL = https://<rsa-tenant>.access.securid.com/AdminInterface/restapi
   • OAuth Issuer URL = https://<rsa-tenant>.auth.securid.com/oauth
   • OAuth Client ID = the Admin API client’s Client ID
   • Private Signing Key (JWK JSON) = the private JWK for the Admin API client
   • OAuth Scopes = rsa.user.manage
   • Code Delivery = EMAIL (RSA emails the user — recommended)
   • Code Validity = 60 minutes 
     
     

     Figure 5. idGenius — RSA SecurID Enrollment fields populated with the Admin API URL, OAuth issuer, client ID, private signing key, scope, and code delivery settings.
        

4. Once the fields are valid, the Enable post-SCIM enrollment toggle becomes active. Turn it ON and click Save Changes. The provider row’s RSA SecurID Enrollments action no longer shows “(enrollment not enabled)”.
   
   

   Figure 6. idGenius — provider list after saving; RSA SecurID Enrollment is enabled on the RSA ID Plus provider.
      

5. Re-open the editor to verify persistence. All values persist, and the signing-key indicator changes from “Not set” to “Key configured” (the key text area is intentionally blank — the API never returns the stored key). The Enable post-SCIM enrollment toggle remains ON.
   
   

   Figure 7. idGenius — values persisted and the signing key shows “Key configured”; post-SCIM enrollment remains enabled

     

Validation 

To confirm the key pair and client configuration work, make a client-credentials token request directly against RSA using private_key_jwt:

• POST https://<rsa-tenant>.auth.securid.com/oauth/token
• grant_type=client_credentials
• scope=rsa.user.manage
• client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
• client_assertion = a JWT signed RS256 with the private key, claims iss = sub = <client_id>, aud = <token endpoint>, jti, iat, exp.

A successful exchange returns HTTP 200 with an access token (token_type: Bearer, expires_in: 300) whose granted scope includes rsa.user.manage. This confirms the RSA OAuth client, public key, issuer/token endpoint, and the idGenius-held private key are all consistent.
   
Note: Once enabled, every user created over outbound SCIM is auto-enrolled in RSA, and RSA emails the user a verification code (valid for the configured window). The code is delivered by RSA directly to the user and never transits to idGenius. This verification code can be used by the user for enrollment with the RSA Authenticator app.