Can't get AMBA SoftToken provisioning working

[David]

Hi Folks !

Here to ask some help to my problem.

I am trying to get software tokens distributed using AMBA, but can't get it working...

Here is my input file (soft.csv) :

Action,SoftTokenProfile
SSTP,iPhone
CIF,Action,TokSerial,TokenType,DestinationSecurityDomain
CTSD,<Token_serial>,4,BNL
CIF,Action,DefLogin,FirstName,LastName,DefShell,SecurityDomain,TokSerial,TokEnabled,MiscVariable,SiteURL1
AUT,cas42,TEST,CAS42,/bin/sh,PARIS,<Token_serial>,1,4,<text>&#x0009;Activation URL: http://127.0.0.1/securid/ctkip?scheme=https&amp;url=securid-ctkip.staging:443/ctkip/services/CtkipService;&#x0026;activationCode=&acd;</text>

Here is my command-line :

/opt/rsa/am/utils/rsautil AMBulkAdmin --verbose -a login -P password -g -i soft.csv

In the log files, I'm getting this :

::::::::::::::
AMBulkAdminLog.txt
::::::::::::::
BOJ    : 2019-01-25 10:20:10 - 8.3.0.2.0 (1402361) - Input = soft.csv
Info   :                                                                -Output Log File Opened
Info   :                                                                -Looking up the License Details
Info   :                                                                -Validating the Enterprise License Check
Info   :                                                                -Key : CoreLevel, Value : Authentication Manager Enterprise
Info   :                                                                -Validating the AM Enterprise License Values for  [ Enterprise License: coreLevelValue =Authentication Manager Enterprise, expirationDate = null ]
Info   :                                                                -A Valid Authentication Manager Enterprise License found, skipping the AMBA License Validation.
Info   :                                                                -Info : License :  - License Number: xxxxxxxxx - Issued To : xxxxxxxxx - Issued On : Thu Dec 28 11:15:46 UTC 2017
Info   :                       Line     1                               -Header Line
Error  : 2019-01-25 10:20:10 : Line                                     -Invalid header field name: SoftTokenProfile
Info   :                                                                -Closing input file
Info   :                                                                -Closing rejected actions file
Info   :                                                                -Closing unsupported actions file
Info   :                                                                -Log File Closed
Info   :                                                                -Exit code: 1
EOJ    : 2019-01-25 10:20:10 - Terminating

::::::::::::::
AMBulkAdminReject.csv
::::::::::::::
Action,SoftTokenProfile

::::::::::::::
AMBulkAdminUnsupportedOptions.txt
::::::::::::::
// Unsupported properties for each input line

Here is my AMBA version infos :

RSA AMBulkAdmin Version: 8.3.0.2.0 (1402361)
Copyright (C) 1994-2018 Dell Inc. or its subsidiaries. All Rights Reserved.

Would be glad if someone could point me what I am missing...

Thanks to all !!

Kind Regards,

David

[David]

Forgot to say what I am trying to get : a software token, with a software token profile, distributed to a user

The CTKIP link will be manually copied from the SecurityConsole Token properties and be sent to the requester via email.

Why not automating the email ? Because we have several stuffs added in it !        

[KevinDouglas]

Hi David:  This is interesting one.  I don't recall this value 'SoftTokenProfile off the top of my head, so I tried your input file on one of my goto AMBA boxes, its running older AM 8.2.02 and reproduced the error, which would be expected as 'SoftTokenProfile' is likely new.  Then I found a bug reference so you might have to end up on 8.4.0.1.

So I tried your input on the closet system I have to yours... AM 8.3.0.5 and it ran without the Error 

-Invalid header field name: SoftTokenProfile

Where did you get details on 'SoftTokenProfile' I didn't see it in either 8.3 or 8.4 AMBA Guide?

[David]

Hi Kevin !

Thanks for getting interested onto my case !        🙂

I found it in the 8.3 "RSA Authentication Manager 8.3 Bulk Administration Utility (AMBA) Guide", at page 39, section "Add User and Token".

For being working on this since yesterday, I guess my mind is starting to get messy about Soft Tokens...

I cannot understand well if I have to use AUT or ATU.

Kind Regards

David

[KevinDouglas]

Thanks for confirming documentation in 8.3  I see it now.   So I downgraded my 8.3.0.5 to 8.3.0.2 and it errors out.

So I think you'll need to get onto 8.3.0.5 in order to use that SoftTokenProfile header value.

[KevinDouglas · Accepted solution]

Hi David:

Found the cause of the issue.  The feature SoftTokenProfile was released in 8.3.0.3.

New Features and Enhancements in Patch 3
Ability to Specify a Software Token Profile in AMBA
Distributing software tokens in RSA Authentication Manager 8.2 or later requires a software token profile. AMBA can specify a software token profile with the SoftTokenProfile attribute and define a global software token profile with the Set Software Token Profile (SSTP) command.
The software token profile allows AMBA to distribute software tokens with CT-KIP and SDTID files. AMBA does not support CTF.
For more information, see the RSA Authentication Manager 8.3 Bulk Administration Utility (AMBA) Guide on RSA Link at https://community.rsa.com/docs/DOC-86018.

[David]

Re Kevin,

Thanks very much for your tries and status on my case !

All seems clear & logical now.

Could you help me on how to get the newer version ? and instructions to have it installed without breaking out the RSA infrastructure ?

Kind Regards

[KevinDouglas]

You'd need to upgrade Authentication Manager to at least 8.3.03  although the latest patch is 8.3.0.6.   Choose your version here: https://community.rsa.com/community/products/securid/authentication-manager/previous-versions/83-downloads 

[David]

Hi Kevin !

Thanks for your answer !

Tried to answer you this weekend, but RSA Link website was experiencing a downtime for maintenance.

[LucaPasi]

Hi,

I've the same error using the ATU Action but I'm using AMBA 8.4, so this bug should already be fixed....