Certified: June 12, 2026
Solution Summary
This article describes idGenius integration with RSA ID Plus as an Identity Source. Use this information to determine which use case and integration type your deployment will employ.
A SCIM Managed Identity Source allows users to be provisioned into RSA ID Plus from an external source via SCIM 2.0 APIs. When a directory is configured as SCIM Managed, users in that directory can only be created, updated, and deactivated via the external source — idGenius in this integration — and not via the RSA Cloud Administration Console.
idGenius is the authoritative source of truth for human non-employee identities (HIDs) — contractors, vendors, interns, support partners, and other third-party workforce members. Once an identity is created, approved, or deactivated in idGenius, the corresponding SCIM User object is pushed into the RSA ID Plus Unified Directory, where RSA enforces authentication and assurance policies at runtime.
Use Case
| Use Case | How It Is Addressed |
|---|---|
| Non-Employee Onboarding – Self-Service Invitation | Admin invites user in idGenius. Once the invite is accepted, the HID is activated, and the subsequent outbound SCIM synchronization provisions the user (POST /Users) in the RSA ID Plus Unified Directory with all required attributes. |
| Delegated Onboarding with Approval and Multi-Factor Authentication (MFA) | A delegated administrator creates the user record in idGenius. The workflow engine routes the request through the approval process, and the HID is activated only after approval. The outbound SCIM provider then provisions the identity to RSA, where ID Plus access policies enforce MFA. |
| Automated Offboarding on Expiration | When the expiration date is reached, or a user is manually disengaged, idGenius policy automation changes the HID status to Inactive. The outbound SCIM provider sends a deactivation request (PATCH active=false) to RSA, while audit records are maintained in both idGenius and the RSA Cloud Administration Console. |
| Enrollment of users with RSA ID Plus authenticators | After each successful outbound SCIM CREATE, idGenius calls the RSA Administration REST API to trigger RSA enrollment, and RSA emails the user a verification code to complete it. The verification code never passes through idGenius. This add-on is configured per outbound provider and is independent of whether the provider authenticates its SCIM channel with an API key or with OAuth. |
Integration Types
SCIM integration allows administrators of Cloud Access Service (CAS) and end users in the CAS Unified Directory to be provisioned in partner applications, and vice versa. End users can request access to an application in the My Page portal and gain access to the external application, depending on the approver type configured in RSA. Users can also check the status of their submitted requests from My Requests on the My Page portal.
RSA Administration API (REST) integrations can provide a rich user interface with all RSA ID Plus features within the partner application.
My Page SSO provides Single-Sign-On (SSO) to idGenius users, leveraging RSA self-service portal My Page. Both SP-initiated SSO and IdP-initiated SSO are supported.
Modern Cloud-hosted SSO with My Page replaces the existing SAML SSO support with the IDR.
Note: RSA will continue to maintain existing SAML SSO integrations using IDR My Applications. At a to-be-determined future date, RSA will announce the end-of-life (EOL) date for the SAML SSO support with the IDR. For more information, see Available Now: My Page SSO Enhancements.
Relying Party integration allows idGenius users’ web browsers to be automatically redirected to CAS for authentication. With Relying Party integration, CAS can manage either additional authentication only or both primary authentication (for example, user ID and password) and additional authentication, depending on the service provider's capability.
Supported Features
This section shows all the supported features by integration type and by RSA components. Use this information to determine which integration type and RSA component your deployment will use. The next section in this guide contains the instruction steps for how to integrate RSA with idGenius using each integration type.
idGenius Integration with CAS
| Authentication Methods | RSA Administration API (REST) | Relying Party | My Page SSO |
| Approve | Supported | Supported | Supported |
| LDAP Password | Unsupported | Supported | Supported |
| SecurID OTP | Unsupported | Supported | Supported |
| Authenticate OTP | Supported | Supported | Supported |
| Device Biometrics | Supported | Supported | Supported |
| SMS OTP | Unsupported | Supported | Supported |
| Voice OTP | Unsupported | Supported | Supported |
| FIDO Security Key | Unsupported | Supported | Supported |
| QR Code | Supported | Supported | Supported |
| Emergency Access Code | Unsupported | Supported | Supported |
Configuration Summary
This section contains instruction steps that show how to integrate idGenius with RSA using all of the integration types.
This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products to install the required components.
All RSA and idGenius components must be installed and working prior to the integration.
This section of the guide includes links to the appropriate sections for configuring both sides for each use case.
Integration Configuration
CAS
- Anomalix idGenius - SCIM Configuration - RSA Ready Implementation Guide
- Anomalix idGenius - RSA Administration API (REST) - RSA Ready Implementation Guide
- Anomalix idGenius - SAML My Page SSO Configuration - RSA Ready Implementation Guide
- Anomalix idGenius - SAML Relying Party Configuration - RSA Ready Implementation Guide
RSA Terminology Changes
The following table describes the differences in the terminologies used in the different versions of RSA products and components.
| Previous Version | New Version | Examples/Comments |
| Cloud Authentication Service | Cloud Access Service | |
| Token | OTP Credential | SecurID OTP Credential |
| Authenticator | Hardware Authenticator | |
| Tokencode | OTP | SecurID OTP, SMS OTP, Voice OTP |
| Access Code | Emergency Access Code | |
| SecurID Authenticate app | RSA Authenticator app | RSA Authenticator app for iOS and Android, RSA Authenticator app for Windows |
| Device | Authenticator | Register an authenticator |
| Company ID | Organization ID | |
| Account | Credential | |
| Device Serial Number | Binding ID |
Certification Details
CAS
idGenius v1.2.x
Known Issues
| Area | Issue/Limitation | Workaround |
|---|---|---|
| Dynamic Assurance Level | ID Plus currently does not support SCIM User schema extensions for cloud-only integrations, and its SCIM interface does not expose Group provisioning for assurance binding. As a result, custom risk attributes published by idGenius cannot be used to drive assurance levels directly in RSA. | Use the standard ID Plus SCIM schema and configure assurance through RSA Access Policies based on supported user attributes such as title, department, and organization. This guide will be updated if ID Plus introduces SCIM schema extensions or SCIM Group support that can be mapped to assurance levels. |
| API Key Handling | The RSA SCIM Service API Key is displayed only when it is created or explicitly viewed. If the key is lost, it must be regenerated, which immediately invalidates the existing key and interrupts any active outbound SCIM client until the new key is configured. | Store the API key securely in the organization's secrets management solution immediately after it is issued. Schedule key rotations during a planned maintenance window to minimize service disruption. |
| Filtered Records in Sync Counters | A non-zero Failed/Filtered count may appear during synchronization when legacy HIDs are missing required SCIM attributes or fail the userName resolution requirements. | Refine the Identity Type and State filters, or remediate the upstream HID attributes (such as work email or external ID) before running Sync Now again. |
| Groups, Third Parties, and Projects | Groups, Third Parties, and Projects are outside the scope of this integration because RSA currently supports provisioning only SCIM Users and does not support SCIM Groups. | Keep Sync Groups, Sync Third Parties as Groups, and Sync Projects as Groups disabled. Configure RSA Access Policies using supported SCIM User attributes instead of group-based assignments. |
Related Articles
Anomalix idGenius - SCIM Configuration - RSA Ready Implementation Guide 7Number of Views Anomalix idGenius - RSA Administration API (REST) - RSA Ready Implementation Guide 4Number of Views Anomalix idGenius - SAML Relying Party Configuration - RSA Ready Implementation Guide 4Number of Views Anomalix idGenius - SAML My Page SSO Configuration - RSA Ready Implementation Guide 2Number of Views Microsoft Entra ID External MFA - RSA Ready Implementation Guide 629Number of Views
Trending Articles
RSA SecurID software token .sdtid file fails to import into RSA SecurID Software Token 5.0 for Windows Customizing TLS Protocol Version RSA MFA Agent 2.5 for Microsoft Windows Installation and Administration Guide How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device RSA Release Notes for RSA Authentication Manager 8.8