RSA Authentication Manager Secure Proxy Server for the Cloud Authentication Service

[#1]

By default, RSA Authentication Manager acts as secure proxy server that sends requests from methods that Authentication Manager cannot validate directly to the Cloud Authentication Service.

You can use RSA Authentication Manager 8.5 as a secure proxy server that sends authentication requests to the Cloud Authentication Service. This feature offers the following benefits:

• Creates one secure connection to the Cloud Authentication Service for authentication requests as opposed to connecting to the Cloud Authentication Service with many authentication agents.

  There is no need to configure firewall rules for multiple authentication agents. You can prevent certain users from accessing external resources, but allow these users to authenticate to the Cloud Authentication Service through Authentication Manager.

• Supports all authentication methods supported by REST protocol authentication agents, whether verified by Authentication Manager or the Cloud Authentication Service.
• Provides high availability using Authenticate Tokencode or RSA SecurID passcodes when RSA Authentication Manager cannot communicate with the Cloud Authentication Service.
• Supports offline authentication to Authentication Manager or the Cloud Authentication Service for the authentication agents that support this feature.

RSA Authentication Manager 8.5 enables this feature by default when you connect to the Cloud Authentication Service or upgrade a deployment that was previously connected with RSA Authentication Manager 8.4 Patch 4 or later. For additional configuration steps, see Configure RSA Authentication Manager as a Secure Proxy Server for the Cloud Authentication Service.

The following table shows the possible deployment options. For more specific information, see your authentication agent documentation.

Scenario	Authentication Methods	High Availability
Direct connection to RSA Authentication Manager 8.5 with the UDP protocol or the REST protocol. RSA Authentication Manager is not connected to the Cloud Authentication Service.	Authentication Manager handles authentication, for example, RSA SecurID hardware and software tokens, on-demand authentication, and Authentication Manager emergency access methods.	Does not apply.
Direct connection to the Cloud Authentication Service with the REST protocol. Authentication Manager is not connected to the Cloud Authentication Service.	The Cloud Authentication Service handles authentication, for example, Approve, Device Biometrics, Authenticate Tokencode, RSA SecurID hardware and software tokens, Emergency Tokencode, SMS Tokencode, and Voice Tokencode.	Does not apply.
Direct connection to RSA Authentication Manager 8.5 with the UDP protocol or the REST protocol. Authentication Manager is connected to the Cloud Authentication Service.	Authentication Manager always validates RSA SecurID hardware and software tokens, on-demand authentication, and Authentication Manager emergency access methods, and Authentication Manager always sends other authentication methods to the Cloud Authentication Service, for example, Authenticate Tokencode, Approve, and Device Biometrics. Authentication Manager automatically downloads High Availability Tokencode records from the Cloud Authentication Service using a batch job that automatically runs each day.	When the Cloud Authentication Service is not available, Authentication Manager prompts users for local authentication with Authenticate Tokencode or RSA SecurID authentication.
Direct connection to the Cloud Authentication Service with the REST protocol is updated to use RSA Authentication Manager 8.5 as a secure proxy server. Authentication Manager is connected to the Cloud Authentication Service.	Authentication Manager sends all authentication requests which are to be proxied to the Cloud Authentication Service, for example, Approve, Device Biometrics, Authenticate Tokencode, RSA SecurID hardware and software tokens, Emergency Tokencode, SMS Tokencode, and Voice Tokencode.	When the Cloud Authentication Service is not available, Authentication Manager prompts users for local authentication with Authenticate Tokencode or RSA SecurID authentication.
RADIUS client agent directly connected to RSA Authentication Manager 8.5. Authentication Manager is connected to the Cloud Authentication Service.	Authentication Manager always validates RSA SecurID hardware and software tokens and Authentication Manager always sends other authentication methods to the Cloud Authentication Service, for example, Authenticate Tokencode, Approve, and Device Biometrics.	When the Cloud Authentication Service is not available, Authentication Manager prompts users for local authentication with Authenticate Tokencode or RSA SecurID authentication.

High Availability Tokencode for the Secure Proxy Server

When Authentication Manager acts as a secure proxy server for the Cloud Authentication Service and the high availability feature is configured, users can access RSA SecurID protected resources when the Cloud Authentication Service or the connection is temporarily unavailable or too slow.

Authentication Manager automatically downloads High Availability Tokencode records from the Cloud Authentication Service. Authentication Manager determines if the Cloud Authentication Service is reachable, and if local authentication is needed.

When the Cloud Authentication Service is not reachable, authentication proceeds as follows:

• Authentication agents prompt users for Authenticate Tokencode or RSA SecurID passcode.
• The access policy in the Cloud Authentication Service is not applied. For example, a user who normally authenticates with Approve or Device Biometrics is prompted for Authenticate Tokencode or RSA SecurID passcode.
• If the Authenticate Tokencode is in Next Token mode or New PIN mode, Authentication Manager uses the downloaded tokencode records to successfully authenticate.
• Authentication Manager determines whether a user is enabled, disabled, or locked. User status from the Cloud Authentication Service is not available until the connection is restored

Authentication records and information about the status of communication between Authentication Manager and the Cloud Authentication Service is recorded in log files and the Authentication Manager System Activity Monitor.

An internal REST protocol agent called @#RSAHighAvailability_#@_InternalAgent1#@ provides High Availability Tokencodes to users when the connection to the Cloud Authentication Service is not available. You cannot edit, enable, disable, or delete this internal agent.

For configuration instructions, see Configure High Availability Tokencodes.

Offline Authentication for RSA Authentication Agents

When you use RSA Authentication Manager 8.5 as a secure proxy server, some authentication agents support offline authentication to the Cloud Authentication Service:

• Offline emergency access codes can be automatically downloaded for users who access the authentication agent. Users can continue to authenticate if the connection to Authentication Manager or the Cloud Authentication Service is not available. For more information, see Emergency Tokencode.
• Authentication agents automatically download offline data day files through Authentication Manager for uninterrupted authentication to the Cloud Authentication Service. If an authentication agent is unable to access Authentication Manager, then the authentication agent uses the downloaded day files for authentication. For instructions on configuring offline authentication, see your agent documentation.

Related Tasks

Configure RSA Authentication Manager as a Secure Proxy Server for the Cloud Authentication Service

Previous Topic:Fully Resynchronize High Availability Tokencodes

Next Topic:Configure RSA Authentication Manager as a Secure Proxy Server for the Cloud Authentication Service

You are here

Table of Contents > RSA Authentication Manager as a Proxy Server to the Cloud > RSA Authentication Manager Secure Proxy Server for the Cloud Authentication Service