Bulk add authentication agents to Security Console

[BENJAMINMORRIS]

Hi RSA,

When my company adds a new tenant, we generally need to add about 7 agents to the Security Console. These agents correspond to Linux database servers, so we don't think the auto-registration guide in https://community.rsa.com/docs/DOC-53802 will work for us.

Is there a tool or setting that would allow us to bulk or batch-add authentication agents to the security console? I'd love a tool similar to the AMBulkAdmin tool that allows for authentication agent import, instead of just user import.

[EdwardDavis · Accepted solution]

AMBulkAdmin can add bulk agents (it cannot be done in security console in bulk)

Add Agent Host
This command is used to perform add, update, remove, list operations associated with the Agent Host.
Action AAH

Required Fields -- Operation
Optional Fields -- AgentHostname, AgentHostAddress, AgentHostType,
AgentRestriction, EnableFlag, SecurityDomain, ClearNodeSecret

---------------------------------------------------------------

Add Agent Hosts
This example adds 10 Agent Hosts (5 are Standard Agents, 5 are Web Agents) that are
unrestricted and enabled.

action,AgentHostName,AgentHostAddress,AgentHostType,AgentRestri
ction,EnableFlag,SecurityDomain,Operation
AAH,win-rsa.vcloud.local,198.75.63.22,1,0,TRUE,BusinessDomain,A
DD
AAH,win22-rsa.vcloud.local,198.75.63.25,1,0,TRUE,BusinessDomain
,ADD
AAH,win23-rsa.vcloud.local,198.75.63.26,1,0,TRUE,BusinessDomain
,ADD
AAH,win24-rsa.vcloud.local,198.75.63.27,1,0,TRUE,BusinessDomain
,ADD
AAH,win25-rsa.vcloud.local,198.75.63.28,1,0,TRUE,BusinessDomain
,ADD
AAH,win26-rsa.vcloud.local,198.75.63.122,2,0,TRUE,BusinessDomai
n,ADD
AAH,win77-rsa.vcloud.local,198.75.63.132,2,0,TRUE,BusinessDomai
n,ADD
AAH,win88-rsa.vcloud.local,198.75.63.102,2,0,TRUE,BusinessDomai
n,ADD
AAH,win99-rsa.vcloud.local,198.75.63.112,2,0,TRUE,BusinessDomai
n,ADD
AAH,win10-rsa.vcloud.local,198.75.63.92,2,0,TRUE,BusinessDomain
,ADD

[BENJAMINMORRIS]

You are a rock star! Thanks a million. My only note would be adding the phrase 'Authentication Agent' to the AMBA guide (https://community.rsa.com/docs/DOC-45506 ) somewhere, so that it's in the official documentation

[BENJAMINMORRIS]

One follow-up question: is it also possible to bulk-enable logon aliases for the newly-added hosts?

[EdwardDavis]

It is in the official AMBA documentation as 'agent host'

and also note, there are some other 'old-naming' in the current AMBA docs,

such as if you want to create a user alias, it not called alias...

GrpDefLogin is the name for alias. 

If you look up the word alias in the AMBA doc, that keyword is only for remote trusted realm names.

[BENJAMINMORRIS]

Ah, I see it now. I was working off an old version of the AMBA guide.

[EdwardDavis]

Yes, AGC.

------------------------------

Look at GrpDefLogin what I pasted in above, that parameter is for user aliases. 

After assigning a user to a group, and then an alias for that user (GrpDefLogin), you can now

activate that group to an agent (so aliases work) with AGC

------------------------------------------------------------------------------------------------------------

here I started with an agent with no groups and no aliases 10.101.99.140

I have a user named ZAZ, who is in aliasgrp, and has an alias ZAZ2

So I want ZAZ2 to be able to access 10.101.99.140

I ran this AMBA input file

action,GrpName,ClntName
AGC,aliasgrp,10.101.99.140

Which gave me the results I need