RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.2 or later

By default, RSA Authentication Manager 8.2 only allows software token lifetime extension when a token is within 15 days of its expiration date. If your organization needs more lead time to manage token renewals — for example, to align with a longer maintenance cycle or to give administrators earlier visibility into expiring tokens — you can change this default window to a custom number of days using the rsautil store command-line utility.

NOTE: For background on how software token lifetime extension works and which tokens are eligible, refer to the RSA Authentication Manager Help — Extending Software Token Lifetimes documentation article before proceeding.

Prerequisites — Before You Begin:

• You must have Operations Console Administrator credentials
• You must have the rsaadmin operating system password for the primary instance
• SSH access must be enabled on the primary instance
• Confirm the IP address or fully qualified hostname of the primary instance before starting

1. Launch an SSH client (such as PuTTY) and connect to the primary instance using its IP address or fully qualified hostname. 
2. Log in with the rsaadmin operating system credentials.
   NOTE: If a different operating system username was selected during Quick Setup, use that username instead of rsaadmin. 
   
3. Navigate to the rsautil directory: 
   

   cd /opt/rsa/am/utils

4. Run the following command to update the token lifetime extension window, replacing <number> with the desired number of days. For example, to set the window to 45 days:
   

   /rsautil store -a update_config auth_manager.extend_token_life.token_days_remaining_for_expiration 45 GLOBAL 503

5. When prompted, enter your Operations Console Administrator username.
6. When prompted, enter your Operations Console Administrator password.
7. Confirm the command completed successfully. The following output appears:
   

   NOTICE: Changed the value of configuration parameter
   'auth_manager.extend_token_life.token_days_remaining_for_expiration'
   from '15' to '45' for the instance 'GLOBAL'.
   update_config
   ---------------
   (1 row)

8. Navigate to the server directory:
   

   cd /opt/rsa/am/server

9. Restart all services on the primary instance:
   CAUTION: The following step restarts all Authentication Manager services on the primary instance. This will cause a brief service interruption. Ensure this is performed during a maintenance window.  
   

   ./rsaserv restart all

    

10. Restart services on each replica instance. Log on to each replica instance, and repeat step 8 and step 9.

Verification: After the restart completes, log in to the Security Console and attempt to extend a software token that is more than 15 days — but within your newly configured window — from its expiration date. Confirm the extension is offered successfully. If the token is still not eligible for extension, confirm the rsaserv restart all command completed without errors on the primary instance.

• Token Eligibility — Distribution Version Requirement: Only software tokens that were distributed in RSA Authentication Manager 8.2 or later are eligible for lifetime extension. Tokens distributed in earlier versions of AM cannot be extended regardless of the window setting configured in this article.

• Token Eligibility — Tokens That Cannot Be Extended: Even after changing the extension window, the following token types remain ineligible for extension:

  • Hardware tokens
  • Software tokens not yet distributed to users
  • Evaluation software tokens with serial numbers in the range 000000000001 to 000000000025
  • Tokens already in the process of being replaced or extended
  • SecurID Authenticate Tokencodes