How to configure RSA SecurID Access with automatic IWA to handle non-Windows devices
3 years ago
Originally Published: 2017-10-09
Article Number
000048227
Applies To
RSA Product Set:  SecurID Access
Issue
IWA can be configured as the default SecurID Access authentication source as described in Enable Automatic Integrated Windows Authentication.
Non-Windows client devices (iOS for example) cannot be integrated with IWA and may "hang" preventing authentication to the SID Access portal.
A network trace with Fiddler or Charles will show that the IWA server generated a 401 Unauthorized response to the client device.
Resolution
DRAFT ONLY - THIS IS NOT A VALID RESOLUTION

The IWA/IIS server's 401 error page can be configured to perform a 302-redirect back to the IDR portal login page. See Create a Custom HTTP Error Response regarding "Respond with a 302 redirect".  The SID Access portal URL should be provided as the 302 redirect address.

When this redirect occurs for the first time, the user will be given the opportunity to log into the portal interactively, but the relay-state (of the originally requested protected resource) will be lost. That is, deep-linking will not work, and the user will land at the application's configured landing page.

The loss of deep-linking should only happen on first authentication however. As long as cookies are not cleared deep-linking should work on subsequent access attempts.
Don't see what you're looking for?