Contents

• Overview
  Passwordless Authentication Methods Supported by RSA
• General CAS Configuration for Web Protected Resources
  1. Configure Enrollment Policy
  2. Enable RSA My Page
  3. Configure Recovery Policy
  4. Configure Live Verify
  5. Review Security Hardening
• User Experience
  Enrollment (First-Time Setup)
  Authentication (Regular Use)
  Recovery (Exception)
  Live Verify
• Passwordless Configuration for RSA MFA Agents
  CAS Policy Configuration
  RSA MFA Agent for Windows
  RSA MFA Agent for macOS
  RSA MFA Agent for UNIX

Overview

Passwordless authentication should be considered part of a security framework aimed at completely eliminating passwords from the user lifecycle, including registration, authentication, and recovery.

It replaces "something you know" (the password)—widely considered the weakest link in security due to credential reuse and data breaches—with a combination of "something you have" (such as a smartphone or security key), "something you know" (such as a PIN), or "something you are" (such as a fingerprint or facial scan). This approach simplifies the user experience while drastically reducing the attack surface for malicious actors.

Passwordless Authentication Methods Supported by RSA

The following table lists the passwordless authentication methods and the RSA and third-party authenticators supported by RSA.

While FIDO2 authentication is considered the most secure and only phishing resistant authentication method, RSA continues to support the other passwordless authentication mentioned above for the following reasons:  

• Legacy systems may not support FIDO2 authentication.  
• Certain organizations or settings may not allow either the use of mobile devices or the ability to plug in USB devices.
• Organizations may not want to deal with the procurement of hardware security keys or professional mobile devices and may not be able to mandate the use of the RSA Authenticator App on personal devices.  

For more information about how FIDO2 is supported and configured by RSA, see Getting Started with FIDO.

Passwordless Authentication has been initially available for web protected resources and is now also available for resources protected by some RSA MFA Agents.

Note the following: 

• This Quick Setup Guide is specifically for configuring passwordless authentication. It assumes that your CAS environment has already been generally configured to work within your organization. It does not provide the details of each of the required steps, but rather highlights the various configurations that may be required, and provides links to existing documentation with more detailed information.  
• Even with a fully configured and deployed passwordless policy, passwords may still be required in "hard-coded" OS functions. For example, when FileVault disk encryption is deployed on a macOS machine, the user must authenticate with a password when rebooting. The same applies on a Windows machine when BIOS protection is enabled. Chrome OS machines also require a password to decrypt local disk resources.

General Cloud Access Service Configuration for Web Protected Resources

To enable passwordless authentication, CAS administrators must complete the following in the Cloud Administration Console:  

1. Configure Enrollment Policy
   You can secure registration using an identity verification workflow to control which users have the right to access self-service enrollment. The My Page Enrollment Policy enables you to add an extra layer of security to the My Page enrollment process using an identity verification provider. It supports different identity verification providers for different user populations.  
2. Enable RSA My Page
   This portal is required for users to manage their own authenticators.   
   - You must use 2.0 Access Policies to define passwordless primary authentication methods with optional step-up authentication methods.
   - Create a 1.0 Access Policy: Use 1.0 Access Policies to define passwordless step-up authentication methods.
   - If you are using both the Applications and Authenticators tabs within My Page, assign a 2.0 Policy to Access > My Page > Applications and a 1.0 Policy to Access > My Page > Authenticators and enable both tabs. With both My Page Applications and Authenticators tabs in use, Applications becomes the default front door for all of My Page.
   - If you use My Page for authenticator management only, then assign a 2.0 Policy to the Access > My Page > Authenticators tab. With only the Authenticators tab in use, the Authenticators tab becomes the default font door for all of My Page.  
   - If you are only using the Authenticators tab within My Page, assign a 2.0 Policy to it and enable that tab. Administrators can also decide which authenticator types to enable, including FIDO2 authenticators.  
3. Configure Recovery Policy
   For users with only 1 registered authenticator device, you can enhance security during recovery by implementing an identity verification workflow, ensuring that only authorized individuals can recover access to My Page self-service in the event of a device that has been lost, stolen, damaged, or upgraded. The My Page Recovery Policy allows you to strengthen the recovery process by integrating an identity verification provider. 
4. Configure Live Verify (optional)
   If you have subscribed to an ID Plus package that includes Live Verify, configure the Live Verify policy. Live Verify allows administrators to securely verify user identity through the user's registered authenticators. This ensures help desk calls are secured from attackers that may impersonate an identity of a user.  
5. Review Security Hardening
   - Code Matching: Requires users to enter or select a code displayed on the login screen into their app to approve a notification.  
   - Device Unlock: Requires users to unlock their mobile device (using PIN or biometrics) before they can approve a notification.  

User Experience  

Enrollment (First-Time Setup)

1. The user downloads the RSA Authenticator App from an official app store or from an organization portal, or acquires a physical authenticator (FIDO Passkey or OTP hardware authenticator).
2. The user should then go to the enrollment URL (/enroll) to begin the enrollment process by first verifying their identity.
3. Once verified, the user follows the registration steps on the My Page screen to securely bind the Authenticator to their identity.

RSA recommends that users have 2 registered authenticators, for example, one RSA Authenticator app and one security key, for resiliency.  

Authentication (Regular Use)

Depending on the Authenticator registered and the Authentication methods enabled by the administrator, subsequent authentication can follow the below flows:

FIDO2 Authentication

Depending on CAS configurations and user registration, users may be able to use different types of FIDO2 Authenticators, such as a security key, the RSA Authenticator app, a synced passkey, or Windows Hello.

QR Code

The user sees a QR Code on the login screen, scans it with their RSA Authenticator App, and performs a biometric check on their device to complete authentication.  

Biometrics

The user receives a push notification on their RSA Authenticator App, performs code matching (if required), and performs a biometric check on their device to complete authentication.  

OTP

The user enters their username and then enters the OTP.  

Emergency Access

If a user loses their registered passwordless authenticators, an administrator can generate a temporary Emergency Access Code to maintain access and productivity.

Recovery (Exception)

In the event that a user with 1 registered authenticator no longer has access to it, the user can replace it through self-service using the Credential Recovery link (/recover). Users will be required to verify their identities first based on the recovery policy. Once verified, they are required to provide the reason for replacing their credential. Consequently, the user's existing authenticator will be unregistered and the user can proceed to registering a replacement authenticator at My Page > Authenticators.

Live Verify

If users require manual assistance from a Help Desk administrator, Live Verify can be used by both parties to ensure that they are interacting with legitimate users.   

The Live Verify flow is as follows:

1. Administrators trigger the start of a Live Verify session.
2. Within the session time limit, users are required to navigate to the Live Verify URL (/verify) and authenticate with their RSA authenticator. 
3. Once a user is verified, Live Verify produces a Verification Code, which must be presented to the administrator for validation. A Verification Code is only produced if the user successfully authenticates and a valid administrator has started the Live Verify session.  

Passwordless Configuration for RSA MFA Agents

Important Notes  

• Support for Passwordless Authentication (FIDO, QR Code, Biometric) for RSA MFA Agents is only availableis only available in certain ID Plus packages. See CAS Policy Configuration below to determine if you can use passswordless with Agents.  
• Passwordless Authentication is not yet supported in all RSA MFA Agents.  
  - For RSA MFA Agent for Windows, passwordless authentication is supported from version 2.4 onwards.  
  - For RSA MFA Agent for macOS, passwordless authentication is supported from version 2.2 onwards.  
  - For RSA MFA Agent for UNIX (formerly PAM), passwordless authentication is supported from version 9.1 onwards.  
  Support for Passwordless Authentication for other Agents is under consideration.
• Passwordless Authentication is supported for Agents connected directly to CAS or in hybrid deployments using Authentication Manager version 8.9 or later, which can act as a secure proxy for CAS.  

CAS Policy Configuration  

If your environment is enabled for Passwordless Authentication with RSA MFA Agents, the list of Primary Authentication Methods available when setting up 2.0  Policy Primary Authentication will include the following methods:  

• QR Code (RSA Agent)  
• Device Biometric (RSA Agent)
• Mobile Passkey (RSA Agent)  

You will need to configure one of these methods as a Default Method and other methods as Alternate Methods to enable passwordless authentication with RSA MFA Agents.

RSA MFA Agent for Windows

Configuring Passwordless Authentication for the RSA MFA Agent for Windows heavily depends on the directory source. See the below table for a summary of the differences:

It is important to note that hybrid-joined devices generally follow the same configuration steps as on-premises AD-joined machines, using GPO settings and AD CS; however, Passwordless Authentication specifically using the RSA CA certificate is currently supported only on Entra ID joined devices and not on hybrid-joined devices.

For detailed configuration information, see the following QSGs:

• Quick Setup Guide - Passwordless Authentication in Windows MFA Agent for Active Directory
• Quick Setup Guide - Passwordless Authentication in Windows MFA Agent for Microsoft Entra ID

Special Case: Remote Desktop (RDP)  

Passwordless Authentication for RDP requires specific handling because it is not directly supported like local logons. The following conditions must be met:

• The source machine must be RSA Passwordless-enabled, and the user must authenticate locally first.  
• The destination machine must have the Smart Card Credential Provider enabled to accept the logon certificate shared from the source.  
• The destination machine must either have the same local user account or be in the same tenant to validate the certificate.  

RSA MFA Agent for macOS  

To configure Passwordless Authentication for the RSA MFA Agent for macOS, you primarily use the RSA Control Center, which is installed with the Agent. Unlike the Windows Agent, which uses GPO settings or PowerShell scripts, an administrator can use the Control Center to define the required configuration, which is then deployed via a configuration package to machines where the RSA MFA Agent for macOS is installed.  

For more information, see the RSA MFA Agent for macOS Installation and Administration Guide for your version of the Agent.

RSA MFA Agent for UNIX  

Passwordless Authentication for the UNIX Agent is enabled during the installation process or by modifying the Agent's properties file. Passwordless Authentication for UNIX is available only for local users, not domain users.  

For more information, see the RSA MFA Agent for UNIX Installation and Administration Guide.