Users cannot log into the RSA Authentication Manager Self-Service Console using the Authenticate OTP
3 years ago
Originally Published: 2023-04-19
Article Number
000068170
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Issue
When a user has registered the SecurID app with the RSA Cloud Authentication Service (CAS) and has no authenticators assigned in RSA Authentication Manager (AM), and AM does not yet "know" that the user has the Authenticate OTP (that is, the Authenticate OTP does not yet show up on their account in the User's Dashboard page in AM as an "Assigned SecurID Token"), the user is unable to log into the AM Self-Service Console with the Authenticate OTP.
Cause
To be able to log into the Authentication Manager Self-Service Console using the Authenticate OTP, the user must have at least one authentication method assigned from Authentication Manager.
Resolution
Any of the following options can be used to allow the user to log into the Authentication Manager (AM) Self-Service Console (SSC) using the Authenticate OTP.
 
  • Have the end user first use the Authenticate OTP to authenticate to a resource (other than the SSC) that is integrated with AM.
  • Assign the user an authenticator temporarily in AM (such as a hardware token, software token, fixed passcode, etc.) and have the user sign into the SSC with the Authenticate OTP while this method is assigned. After the user logs into the SSC with the Authenticate OTP successfully, the other authentication method that was assigned temporarily can be unassigned.
  • Run command line utility to "Enable the RSA SecurID Authenticate App for Specific User."
  • Enable the "High Availability Tokencode" feature. By default when enabled, the High Availability Tokencode sync job runs every 24 hours. If needed, this sync job can be configured to run more frequently; however, please note that setting the job to run too frequently can affect performance. To change the frequency of this sync job, the following can be done:
    1. SSH to the primary Authentication Manager server.
    2. Navigate to the /opt/rsa/am/utils directory: cd /opt/rsa/am/utils
    3. Run the following command: ./rsautil store -a update_config auth_manager.cas.authentication.ha.seed_sync_interval <sync job interval in minutes> GLOBAL
    4. Enter the Operations Console administrator's credentials when prompted.


 

Don't see what you're looking for?