RSA Product Set: SecurID
RSA Product Version: AM 8.x
Authentication using hardware tokens in CyberArk fails, and the Authentication Activity Monitor logs the error: "Bad tokencode but good PIN." This occurs even when the passcode is valid.
However, testing authentication with the same token and credentials is successful through the Self-Service Console.
The failure occurs because the hardware token generates a passcode that combines a 4-digit PIN with a 6-digit tokencode, resulting in a 10-digit passcode. CyberArk does not accept passcodes of this length, leading to the "Bad tokencode but good PIN" error during authentication.
As a workaround, disable the PIN requirement for the affected hardware tokens as outlined in this article Allow a User to Authenticate Without an RSA SecurID PIN.
Alternatively, contact CyberArk Support for further assistance.
Related Articles
Cloud Administration Delete Hardware Token API Number of Views Assign a Hardware Token to a User Number of Views RSA Hardware Authenticators Number of Views Assign Hardware Tokens to Multiple Users Number of Views Registering RSA SID 700 hardware tokens in Microsoft Entra ID Number of Views
Trending Articles
How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device RSA-2026-10: RSA Authentication Manager Security Update for Third-Party Component Vulnerabilities Download RSA SecurID Access Cloud User Event audit logs using Cloud Administration REST API CLU RSA SecurID Desktop Token 5.0.3 for Windows Administrator's Guide RSA SecurID Software Token 4.2.1 for Mac OS X Administrator's Guide
