RSA SecurID IIS web agent giving 403 after successful authentication

[zammo]

We are setting us a new server with IIS and RSA Securid to replace an existing server.

One the new server we can successfully authenticate using RSA Securid soft token but when it gets redirected back to the website we get a 403 forbidden error. The 2 servers look to be set up s similar as possible. The old one has an old version of the agent (7.1) whilst the new one is using 8.0.5

Managed to get tracing to run but nothing obvious from that or the event logs.

Any ideas or things to try?

[EricaChalfin · Accepted solution]

@zammo,

Welcome to the RSA community! We are so glad that you joined us!

Can you upgrade the agent so they are both running Authentication Agent 8.0.5 for IIS Web Server?

For the 403 error, you can try setting MatchOnSecurIDUsername to 0. This tells the web agent that it is OK if the SecurID user name is not exactly the same as the credentials used for application sign on.  If there are differences and MatchOnSecurIDUsername is not set, or if it is set to 1, the user will get a Forbidden page
 
Do the following:

1. Open the registry on the web agent server.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\SDTI\RSAWebAgent.
3. Set MatchOnSecurIDUsername = 0 (REG_DWORD).
4. After updating the registry, the server must be rebooted for the change to take effect.

If this does not work, please contact RSA support and open a support ticket.

[zammo]

Great. That looks to have sorted it.

We are replacing the old server so didn't want to upgrade it but the new one looks to be working okay now and we can do a full test now