An identity router is a virtual appliance that enforces authentication and access for users of protected applications, manages single sign-on (SSO), and connects the RSA Via Access hosted service to enterprise resources such as Active Directory and RSA Authentication Manager.
An identity router® is a virtual appliance that enforces authentication and access for users of protected applications, manages single sign-on (SSO), and connects the RSA Via Access hosted service to enterprise resources such as LDAP directory servers and RSA Authentication Manager.
You install the identity router as a virtual appliance on your network using a VMware image, which includes all necessary identity router applications. Your RSA Via Access deployment may include multiple identity routers, which can operate in clusters to provide additional features and reliability. You can use a network load balancer to distribute workload among identity routers based on the available capacity. RSA recommends that you deploy identity routers in clusters of three. For information on protecting the identity router environment, see the RSA Via Access Security Configuration Guide.
The identity router performs these main functions:
- Connects the RSA Via Access hosted service to enterprise resources, such as LDAP directory servers and RSA Authentication Manager.
- Hosts the application portal, which provides a convenient interface where users can view and access protected applications.
- Authenticates users to the application portal and tracks sign-in sessions for protected applications.
- Manages sign-in session duration for HTTP Federation (HFED) and trusted header applications, and the application portal.
- Enforces step-up authentication, connecting users to the RSA Via Access hosted service to provide additional authentication credentials when required.
- Manages SSO for applications that support Security Assertion Markup Language (SAML), as well as non-SAML applications. Users who satisfy the authentication requirements to access one application are not required to re-enter the same authentication credentials to access a second application that uses the same or lower assurance level during the same SSO session.
- Provides HFED to enable SSO for non-SAML applications.
- Extends Integrated Windows Authentication and LDAP directory server user password SSO functionality to protected applications.
- Supports SAML "just-in-time" user provisioning, allowing compatible applications to create new user accounts based on extended attributes contained in SAML assertions.
