Enable SecurID Token Users to Access Resources Protected by Cloud Access Service
a day ago

Enable SecurID Token Users to Access Resources Protected by Cloud Access Service

RSA supports two connection types between Authentication Manager (AM) and Cloud Access Service (CAS), depending on the direction of authentication.

Connection from AM

This connection type allows users to access on-premise, agent-protected resources using cloud-based authenticators such as the RSA Authenticator app. Configure this connection in the Security Console. For more information, see Connect Authentication Manager to the Cloud Access Service.

Connection to AM

This connection type allows users to access cloud-protected resources using SecurID authenticators that are managed in AM. You must connect the identity router to AM to enable this setup.

The connection to AM supports the following agent connection types:

  • REST Agent connection: Uses a REST agent connection between the identity router and AM. This method requires the AM root certificate, all AM primary and replica fully-qualified domain names, SecurID Authentication API port number and agent name provided by the AM administrator.

  • TCP Agent connection (Legacy): Uses a TCP agent connection between the identity router and AM. This method requires the AM configuration file (sdconf.rec) and agent name.

The configuration described below uses the second connection type, Connection to Authentication Manager, so that users with SecurID tokens that are assigned in AM can access SaaS and on-premises web applications and RADIUS clients protected by CAS. The identity router for CAS acts as an agent to AM.

For more information, see:

 

Authentication Process Overview

The following illustration shows the process flow for a SecurID user accessing a resource protected by a CAS IDR SSO Agent or RADIUS. AM validates the SecurID tokencode and returns information to the identity router before the user is granted access.

 

ngx_g_am_cloud_sidtoken_authflow

 

Required Components

ComponentDetails
CAS

Use the Cloud Administration Console to download the identity router software or deploy an embedded IDR in AM.

You must deploy at least one identity router and configure the required components for a minimal deployment that allows Authentication Manager users to authenticate to resources protected by CAS. See RSA Cloud Access Service Deployment Overview.

AMAny supported version of AM with at least one primary instance.

Required Tasks

The configuration consists of the following tasks for TCP Agent and REST Agent connections. Complete the tasks that apply to your connection type.

Person ResponsibleTCP Agent TaskREST Agent Task
Super Admin for AM 

1. In AM, Configure and Enable the RSA SecurID Authentication API for Authentication Agents if not already configured and enabled.

2. Inform the Network Administrator and the Super Admin for CAS of the SecurID Authentication API port number, as well as the fully qualified domain names for the AM primary and all replicas.

Network Administrator for CAS

1. Confirm that your network allows outbound TCP traffic from the identity router to the Authentication Manager servers on port 5500.

2. For each identity router with two network interfaces, add an A record to the internal domain name server (DNS) that maps the identity router’s portal hostname to its portal interface IP address.

For each identity router with one network interface, add an A record to the internal DNS that maps the identity router’s portal hostname to its management interface IP address.

3. Confirm that your network allows outbound TCP traffic from the Identity (IDR) to Authentication Manager (AM) on the AM SecurID Authentication API port. The default port is TCP 5555.

For each identity router with one network interface, add an A record to the internal DNS that maps the identity router’s portal hostname to its management interface IP address. For IDRs with two interfaces: Inform the Super Admin for CAS which IDR interface must be used to connect to AM.

Super Admin for CAS

3. Configure a Static Route to AM

4.Configure a Static Route to AM

Super Admin for AM

4. Generate the AM Configuration File

5. Add the identity router to AM as an agent. For instructions, see the following topics:

Note:  Perform step 5 once for all identity routers in your deployment. Do not add an agent for each identity router.

5. Obtain the AM root certificate. For information, see how to Download the RSA Authentication Manager Console Root Certificate in DER Format.

6. Configure an agent for CAS in the AM Security Console in Access > Authentication Agents. For information, see Deploying an Authentication Agent That Uses the REST Protocol.

When configuring an agent for a connection from CAS to AM, choose the following configuration options:

  1. For Hostname, set a logical name for the agent.

  2. IP address must not be set.

  3. Agent type is Standard Agent.

  4. Other settings can be left at their defaults.

  5. Give the hostname to the Super Admin for CAS (case-sensitive).

7. Get the access key to give to the Super Admin for CAS.

On Authentication Manager 8.8 and later versions, the AM Administrator must add an Agent Credential for IDRs to use. The Access Key is one of the system-generated values included in that credential. For more information, see the "Add an Agent Credential" section on Agent Credentials. An AM Administrator can add a note to the Agent Credential to indicate that the credential is intended for IDR use.

On Authentication Manager 8.7 SP2 and earlier versions, the Access Key can be obtained as follows:

  1. Open the Security Console.

  2. Navigate to Setup > System Settings.

  3. Under Authentication Settings, click RSA SecurID Authentication API.

Super Admin for CAS

6. Connect Your CAS Deployment to AM

8. Connect Your CAS Deployment to AM

Configure a Static Route to AM

For on-premises identity routers deployed in your VMware or Hyper-V environment, the Super Admin for CAS can configure static routes to restrict communication between IDR(s) and a specific AM server. The default interface for connecting IDRs to AM, is the IDR's eth1/proxy/public interface. A static route configured for an IDR in the Cloud Administration Console is required where a two-interface IDR must use its eth0/mgmt/private interface to connect to AM. A static route is not required if the default route can be used, which is via the IDR's eth1/proxy/public interface, or if it is a single-interface IDR.

You must configure a static route when you initially configure CAS to communicate with AM, as well as each time an AM instance is added or removed from the deployment.

You can configure either of the following:

  • If AM servers are on different networks, configure a static route for each identity router in your deployment to each AM server.
  • If all AM servers are on the same network, configure one static route for each identity router in your deployment going to that network to restrict the connections for the entire AM deployment.

Note:  This method for static route configuration is not available for identity routers deployed in the Amazon Cloud or Microsoft Azure. Instead, you must configure route tables in your Amazon Web Services environment to enable each identity router in your VPC to reach Authentication Manager. Refer to your Amazon Web Services documentation for instructions. For Microsoft Azure, this is handled by Azure configuration during network setup for Azure IDR.

The following graphic shows how the example IP addresses from the procedure are used to configure a static route from an identity router to the AM appliance(s).

ngx_g_static_route_idr_to_am

Before you begin 

  • You must be a Super Admin in the Cloud Administration Console for CAS.

  • Ensure that your network allows outbound TCP traffic from the identity router to the AM server on port 5500 for TCP Agent or port 5555 for REST Agent.

Procedure 

  1. In the Cloud Administration Console, click Platform > Identity Routers.
  2. Next to the identity router name, select Edit.
  3. Click Next Step to access the Settings page.
  4. In the Static Routes section, do the following.
    • To restrict an individual AM server to the identity router management interface, enter these settings:
      • IP Address:<Authentication Manager Server IP Address>

        For example, 192.168.20.7

      • Network Mask: 255.255.255.255
      • Gateway:<Default Gateway for Identity Router Management Interface>

        For example: 10.10.10.1

        Device: Private

    • To restrict a network containing all AM servers, use these settings:
      • IP Address:<AM Server Network>

        For example, 192.168.20.0

      • Network Mask:<Network Mask for AM Server Network>

        For example, 255.255.255.128

      • Gateway:<Default Gateway for Identity Router Management Interface>

        For example: 10.10.10.1

        Device: Private

  5. Click Add.
  6. Click Next Step.
  7. Click Save and Finish.
  8. Repeat step 2 through step 6 for each identity router in your deployment.
  9. Click Publish Changes.

After you finish 

A Super Admin for AM must Generate the AM Configuration File.

Generate the AM Configuration File

You must configure communication between the authentication agents and AM. To do this, use the Security Console to generate a zip file (AM_Config.zip) that contains the AM configuration file, sdconf.rec. To configure communication, you copy sdconf.recto each agent host. The sdconf.rec file contains a snapshot of the server topology as it was when the file was generated. The agent uses the data in the sdconf.rec file as a backup.

The generated zip file also contains a failover.dat file that can be configured on the agent. The failover.dat file allows agent auto-registration to complete when the primary instance is unavailable or separated from the agent host by a firewall that uses Network Address Translation (NAT). This file includes a list of the primary and replica instances, and their alias IP addresses.

You must configure communication between the authentication agents and AM. To do this, use the Security Console to generate a zip file (AM_Config.zip) that contains the AM configuration file, sdconf.rec. To configure communication, you copysdconf.recto each agent host. The sdconf.rec file contains a snapshot of the server topology as it was when the file was generated. The agent uses the data in the sdconf.rec file as a backup.

The generated zip file also contains a failover.dat file that can be configured on the agent. The failover.dat file allows agent auto-registration to complete when the primary instance is unavailable or separated from the agent host by a firewall that uses Network Address Translation (NAT). This file includes a list of the primary and replica instances, and their alias IP addresses.

Before you begin 

  • Make sure an agent is connected to AM.
  • Review the configuration settings. See Configure Agent Settings.

Procedure 

  1. In the Security Console, click Access > Authentication Agents > Generate Configuration File.
    AM_Config_File_1076x438
  2. In the Maximum Retries drop-down list, select the number of times you want the authentication agent or identity router to attempt to establish communication with AM before returning the message Cannot initialize agent - server communications.
  3. In the Maximum Time Between Each Retry drop-down list, select the number of seconds that you want to set between attempts by the authentication agent or identity router to establish communications with AM.
  4. Click Generate Config File.
  5. Click Download Now, and save AM_Config.zip to your local machine.

After you finish 

If you are configuring an agent:

  • Copy AM_Config.zip, containing the sdconf.rec file and the failover.dat file, to each agent host. The agent uses the data in the sdconf.rec file as a backup.
  • Configure the agent with the new sdconf.rec file and if necessary, the failover.dat file. For instructions, see your agent documentation.

If you are configuring an agent:

  • Copy AM_Config.zip, containing the sdconf.rec file and the failover.dat file, to each agent host. The agent uses the data in the sdconf.rec file as a backup.
  • Configure the agent with the new sdconf.rec file and if necessary, the failover.dat file. For instructions, see your agent documentation.

The Super Admin for CAS must unzip the AM_Config.zip file and upload the sdconf.rec file to the identity router. See Connect Your Cloud Access Service Deployment to Authentication Manager.

 

Connect Your CAS Deployment to AM

Certificate is expired or not yet valid” “Uploaded certificate is not a Root CA” “Certificate is not self-signed” “Certificate does not allow certificate signing” “Validate the IDR version during certificate upload. If the IDR version is below 12.26.x, only DER format is supported; PEM is not supported”

Based on your IDR environment and AM deployment configuration, select one of the following connection methods:

  • REST Agent Connection

  • TCP Agent Connection (Legacy)

When your CAS deployment is connected to AM, users can access cloud-protected resources using RSA authenticators managed in Authentication Manager (AM).

You can configure the connection to AM based on your current IDR environment and configuration state as follows:

  • If all IDRs are upgraded to version 12.24.0.0.0 or later and a TCP agent connection exists, both TCP and REST agent configuration options are available. In this case, it is recommended to reconfigure the connection using the REST agent option.

  • If one or more IDRs are not upgraded to version 12.24.0.0.0 or later and have an existing TCP agent connection, only the TCP agent configuration option is available. Therefore, upgrade the IDR to the latest version to enable transition to the REST agent.

  • If no IDR is present or there is no existing TCP agent connection, only the REST agent option is available. You can configure the connection without an identity router; however, the connection will be inoperative and Test Connection will fail unless at least one identity router is available.

The configuration settings on this page allow all identity routers to connect CAS to AM for the purpose of allowing users with SecurID Tokens assigned to them in AM to use those tokens to log in to applications protected by CAS. It is also possible to connect AM to CAS. For information, see Select an Integration Path for Authentication Manager and Cloud Access Service.

 

Before you begin

Before you configure the connection between CAS and AM, ensure that you meet the following requirements.

  • You must be a Super Admin in the Cloud Administration Console for CAS.
  • Confirm that a static route is configured, if required, to each AM server for each identity router in your deployment. For instructions, see Configure a Static Route to RSA Authentication Manager.
  • Deploy at least one identity router. For information, see Planning Your Identity Router Deployment and Installing and Configuring Identity Routers.

 

REST Agent Connection Requirements

  • Confirm that your network allows outbound TCP traffic from the required IDR interface to AM on the AM SecurID Authentication API port.

  • Your AM Administrator must ensure the SecurID Authentication API is enabled in the AM Security Console. See Configure the RSA SecurID Authentication API for Authentication Agents.

  • Obtain the AM Root Certificate. For information, see Certificate for REST Agent Connection to Authentication Manager in Cloud Access Service Certificates.

  • For a REST agent connection, you need to obtain the following details from your AM Administrator:

    • AM primary instance hostname: The host name is the Fully Qualified Domain Name specified in the AM primary's Operations Console in Administration > Network > Appliance Network Settings. See Change the Primary Instance IPv4 Network Settings.

    • The AM SecurID Authentication API port number: This is the Communication Port specified in the Security Console in Setup > System Settings > RSA SecurID Authentication API. See Configure the RSA SecurID Authentication API for Authentication Agents.

    • AM replica instance hostnames: The hostname is the Fully Qualified Domain Name specified in each AM replica's Operations Console in Administration > Network > Appliance Network Settings. See Change the Replica Instance IPv4 Network Settings.

    • The Authentication Agent Name: This is a case-sensitive value. This is the Hostname of the agent configured for CAS in the AM Security Console in Access > Authentication Agents.

    • Access Key: Obtain the Access Key from AM.

 

TCP Agent Connection Requirements

  • Confirm that your network allows outbound traffic from the identity router to the AM server on TCP port 5500.

  • A person with Super Admin privileges in AM must create an agent record in AM. If you did not do this, you must obtain the agent name and the location of the sdconf.rec file from the AM Super Admin.
  • For AM versions earlier than 8.2 SP1, use the Operations Console to add the hostname and IP address for the identity router to the AM server hosts file. For identity routers in the Amazon cloud, add the private IP address. For on-premises identity routers, add the hostname and IP address of both the proxy and management interfaces if both are used. To view and modify the hosts file, sign into the Operations Console and click Administration > Network > Hosts File.

Procedure 

  1. In the Cloud Administration Console, click Platform > Authentication Manager.
  2. Click Configure Connection.
    CAS_Connect_to_AM_956x367

  3. Based on your IDR environment, select the appropriate connection option and complete the required fields in the Configuration Settings dialog box:

    • REST Agent

      1. Authentication Agent Name: Enter the exact name your Authentication Manager (AM) Administrator provides.

        This value is case-sensitive. The AM agent name configured in the Cloud Administration Console must exactly match the agent name configured in AM. Configuring an invalid agent name will result in authentication failure.

      2. Primary URL: Enter the URL in the format https://<AM_PRIMARY_INSTANCE_HOSTNAME>:<PORT>. Use the AM primary instance hostname and the AM SecurID Authentication API port number provided by your AM Administrator.

      3. Replica URL(s) (optional): Click Add to enter a replica AM instance URL, if available, in the format https://<AM_REPLICA_INSTANCE_HOSTNAME>:<PORT>. Use the AM replica instance hostnames provided by your AM Administrator. Use the same PORT as the primary URL's port.

      4. Access Key: Enter the access key that your AM Administrator provides.

      5. Click Choose file and upload the Root CA certificate provided by your administrator. DER and PEM certificate formats are supported. For IDR versions earlier than 12.26.x, only DER certificates are supported. The certificate must be a valid, self-signed Root CA certificate that supports certificate signing.

    • TCP Agent (Legacy)

      1. In the Authentication Agent Name field, enter the exact name provided by your AM Administrator.

      2. To upload the sdconf.rec file, click Choose File and select the file.

      CAS_AM_Config_Settings_571x320

  1. Click Save.

  2. Click Publish Changes to apply the settings to all identity routers in the deployment. You must publish before you test the connection, but remember that publishing applies these settings and all pending changes to all identity routers.

  3. Click Test Connection. A graphic shows the connection status for each configured identity router. If any components are not connected, investigate the cause.
    CAS_AM_Test_Connection_969x206


After you finish

A graphic shows the connection status for each configured identity router. If any components are not connected, investigate the cause.

The Super Admin for CAS must make sure assurance levels and access policies are configured to require SecurID Token where appropriate. For more information, see Access Policies.

 

Don't see what you're looking for?