This section describes how to integrate SecurID Access with Radiant Logic RadiantOne Cloud Federation Service using the Authentication API.

Architecture Diagram

Login / Password

Login into CFS with your Tenant Administrator account and navigate to Authentication | Login / Password.

Configuration

• Enable the Login / Password authentication on CFS Master and / or CFS Proxy.

• Enter the name of the attribute that will be used to identify the user in the identity store to validate the credentials.

• Enter the message you want your users see to know what identifier to use when login in (e.g. Username or Email Address).

• Every authentication method is associated with a Level of Assurance (LOA) This level can be used to enforce access permissions for applications. To indicate the LOA a person will be associated with when they login with a login / password, select the appropriate value from the "Level of Assurance" drop-down list.

This is the login page when you enable Login / Password authentication.

RSA SecurID

You can configure RSA SecurID to be embedded into the Login / Password form.

• Enable the feature.

• Enter the URL of the RSA server, including the port your Authentication API listens on. Please refer to the RSA documentation to ensure you have the authentication API configured properly.

• Enter the Access Key for the Authentication API.

• Enter the authenticaton agent name that is used with the Authentication API. Please refer to the RSA documentation linked above for how to configure the agent.

• Enter the FID attribute that correponds to your users' User ID in RSA.

• Enter a text to help your users provide the correct information in the form.

• Every authentication method is associated with a Level of Assurance (LOA). This level can be used to enforce access permissions for applications. To indicate the LOA a person will be associated with when they login with a login / password, select the appropriate value from the "Level of Assurance" drop-down list.

This is the login page when you enable RSA SecurID in the Login / Password form.

Two-Step Verification

RadiantOne CFS has it's own two-step verification system.

• You can force the two-step verification for every single user trying to login with Login / Password authentication.

• Allow the users to Identity verification with a smartphone application to use the two-step verification.

• Every authentication method is associated with a Level of Assurance (LOA). This level can be used to enforce access permissions for applications. To indicate the LOA a person will be associated with when they login with a login / password, select the appropriate value from the "Level of Assurance" drop-down list.

Note: This feature cannot be combine with RSA SecurID.

When the user login using a login / password, he will be asked to provide a temporary password.

• If he is using a smartphone application, he can choose "I have a code" and enter the one provided by the application. See how to enable two-step verification for the user.

• He can request an email containing the temporary code.

• If the external service Twilio is configured, he can request a text message or a phone call.

Return to the main page for more certification related information.