Software Token Expiration Extension

[CarlaBradley]

I read about extended the software token expiration and just want to make sure I'm understanding it correctly. It says, "For example, a token that will expire in 15 days can be extended so that it will not expire for another 2 years. An unassigned token that expires in 2 years provides a new expiration date to the distributed token that was expiring in 15 days, and the unassigned token is deleted. The original, distributed token on the user device receives an extended lifetime in Authentication Manager."

So assuming my token expires in 2 weeks, I can go into the Security Console and extend my expiration date for 2 more years. It basically uses up a different (unassigned) token that has a 2 year expiration. Logically transferring the extra 2 year expiration to the assigned token, deleting the unassigned token, and this is all done in the security console with nothing for the end user to do? When that token expires in two years, it can be done again? And lifetime doesn't mean no expiration, right?

FYI - We are on 8.2 SP1 Patch 8 and about to go to 8.3.

[EdwardDavis · Accepted solution]

Yes, the only pre-condition is the token on the user device must have been issued from version 8.2 or higher RSA server, so it's death date on the user side is year 2035. If so, you can extend that token forever up to Dec 31 2035. You can even use tokens that expired in 2008 (or whenever), distribute it to an end user, and then extend it with a new unexpired token, and now that old serial number token from 2008 will be working and have the lifetime of the token you extended it with.

[CarlaBradley]

That's awesome and it's a standard two years even if it uses a token that doesn't expire for three years?

[EdwardDavis]

No it is not a standard two years, two years is just the example given. It is whatever the paid-for lifetime is on the tokens you are extending with. 1 day or 5 years, whatever the extension token death date is, will be the extended token death date.

[GabrielPython]

You can jump the step of assigning expired Software Token.

If you have not distributed all your Extended LifeTime token before the software Token died, they will appear in the unassigned token list.

If you need to assign a new Software Token, from the User List, you will not see the Extended LifeTime Token.

Workaround: if You list your unassigned Software Token, you'll get the list of unassigned Extended LifeTime Token, and You can select one and assign it to a user. Once distributed, it appears as Software Token, Expendable.

Tested on 8.2SP1P8 and 8.3.