Anomalix idGenius - RSA Ready Implementation Guide
a day ago

Certified: June 12, 2026

       

Solution Summary

This article describes idGenius integration with RSA ID Plus as an Identity Source. Use this information to determine which use case and integration type your deployment will employ.

A SCIM Managed Identity Source allows users to be provisioned into RSA ID Plus from an external source via SCIM 2.0 APIs. When a directory is configured as SCIM Managed, users in that directory can only be created, updated, and deactivated via the external source — idGenius in this integration — and not via the RSA Cloud Administration Console.
idGenius is the authoritative source of truth for human non-employee identities (HIDs) — contractors, vendors, interns, support partners, and other third-party workforce members. Once an identity is created, approved, or deactivated in idGenius, the corresponding SCIM User object is pushed into the RSA ID Plus Unified Directory, where RSA enforces authentication and assurance policies at runtime.

        

Use Case

Use CaseHow It Is Addressed
Non-Employee Onboarding – Self-Service InvitationAdmin invites user in idGenius.  Once the invite is accepted, the HID is activated, and the subsequent outbound SCIM synchronization provisions the user (POST /Users) in the RSA ID Plus Unified Directory with all required attributes.
Delegated Onboarding with Approval and Multi-Factor Authentication (MFA)A delegated administrator creates the user record in idGenius. The workflow engine routes the request through the approval process, and the HID is activated only after approval. The outbound SCIM provider then provisions the identity to RSA, where ID Plus access policies enforce  MFA.
Automated Offboarding on ExpirationWhen the expiration date is reached, or a user is manually disengaged, idGenius policy automation changes the HID status to Inactive. The outbound SCIM provider sends a deactivation request (PATCH active=false) to RSA, while audit records are maintained in both idGenius and the RSA Cloud Administration Console.
Enrollment of users with RSA ID Plus authenticators
After each successful outbound SCIM CREATE, idGenius calls the RSA Administration REST API to trigger RSA enrollment, and RSA emails the user a verification code to complete it. The verification code never passes through idGenius. This add-on is configured per outbound provider and is independent of whether the provider authenticates its SCIM channel with an API key or with OAuth.

         

Integration Types

SCIM integration allows administrators of Cloud Access Service (CAS) and end users in the CAS Unified Directory to be provisioned in partner applications, and vice versa. End users can request access to an application in the My Page portal and gain access to the external application, depending on the approver type configured in RSA. Users can also check the status of their submitted requests from My Requests on the My Page portal.

    
RSA Administration API (REST) integrations can provide a rich user interface with all RSA ID Plus features within the partner application. 

      

My Page SSO provides Single-Sign-On (SSO) to idGenius users, leveraging RSA self-service portal My Page. Both SP-initiated SSO and IdP-initiated SSO are supported.
Modern Cloud-hosted SSO with My Page replaces the existing SAML SSO support with the IDR. 

Note: RSA will continue to maintain existing SAML SSO integrations using IDR My Applications. At a to-be-determined future date, RSA will announce the end-of-life (EOL) date for the SAML SSO support with the IDR. For more information, see Available Now: My Page SSO Enhancements

      
    
Relying Party integration allows idGenius users’ web browsers to be automatically redirected to CAS for authentication. With Relying Party integration, CAS can manage either additional authentication only or both primary authentication (for example, user ID and password) and additional authentication, depending on the service provider's capability.

         

Supported Features

This section shows all the supported features by integration type and by RSA components. Use this information to determine which integration type and RSA component your deployment will use. The next section in this guide contains the instruction steps for how to integrate RSA with idGenius using each integration type.

         

idGenius Integration with CAS

Authentication MethodsRSA Administration  API (REST)Relying PartyMy Page SSO
ApproveSupportedSupportedSupported
LDAP PasswordUnsupportedSupportedSupported
SecurID OTPUnsupportedSupportedSupported
Authenticate OTPSupportedSupportedSupported
Device BiometricsSupportedSupportedSupported
SMS OTPUnsupportedSupportedSupported
Voice OTPUnsupportedSupportedSupported
FIDO Security KeyUnsupportedSupportedSupported
QR CodeSupportedSupportedSupported
Emergency Access CodeUnsupportedSupportedSupported

                        

Configuration Summary

This section contains instruction steps that show how to integrate idGenius with RSA using all of the integration types.
This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products to install the required components.
All RSA and idGenius components must be installed and working prior to the integration.
This section of the guide includes links to the appropriate sections for configuring both sides for each use case.
      

Integration Configuration

CAS

                  

RSA Terminology Changes

The following table describes the differences in the terminologies used in the different versions of RSA products and components. 

Previous VersionNew VersionExamples/Comments
Cloud Authentication ServiceCloud Access Service
Token

OTP CredentialSecurID OTP Credential
AuthenticatorHardware Authenticator
Tokencode

OTPSecurID OTP, SMS OTP, Voice OTP
Access CodeEmergency Access Code
SecurID Authenticate appRSA Authenticator appRSA Authenticator app for iOS and Android, RSA Authenticator app for Windows
DeviceAuthenticatorRegister an authenticator
Company IDOrganization ID 
AccountCredential 
Device Serial NumberBinding ID 

           

Certification Details

CAS

idGenius v1.2.x

        

Known Issues

AreaIssue/LimitationWorkaround
Dynamic Assurance LevelID Plus currently does not support SCIM User schema extensions for cloud-only integrations, and its SCIM interface does not expose Group provisioning for assurance binding. As a result, custom risk attributes published by idGenius cannot be used to drive assurance levels directly in RSA.Use the standard ID Plus SCIM schema and configure assurance through RSA Access Policies based on supported user attributes such as title, department, and organization. This guide will be updated if ID Plus introduces SCIM schema extensions or SCIM Group support that can be mapped to assurance levels.
API Key HandlingThe RSA SCIM Service API Key is displayed only when it is created or explicitly viewed. If the key is lost, it must be regenerated, which immediately invalidates the existing key and interrupts any active outbound SCIM client until the new key is configured.Store the API key securely in the organization's secrets management solution immediately after it is issued. Schedule key rotations during a planned maintenance window to minimize service disruption.
Filtered Records in Sync CountersA non-zero Failed/Filtered count may appear during synchronization when legacy HIDs are missing required SCIM attributes or fail the userName resolution requirements.Refine the Identity Type and State filters, or remediate the upstream HID attributes (such as work email or external ID) before running Sync Now again.
Groups, Third Parties, and Projects
Groups, Third Parties, and Projects are outside the scope of this integration because RSA currently supports provisioning only SCIM Users and does not support SCIM Groups.
Keep Sync Groups, Sync Third Parties as Groups, and Sync Projects as Groups disabled. Configure RSA Access Policies using supported SCIM User attributes instead of group-based assignments.