- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Token code without PIN.
Hi Team,
We are currently on the version 8.0.5.0
We tried distributing the soft token via AMBA. We created a soft token profile based on iOS 2.x.
Even though we have selected for "No Pin Code" (only token code), in the soft token application it is asking for a pin.
Below are the AMBA commands useed:
Action,SoftTokenProfile
SSTP,ios-special-1
CIF,Action,TokSerial,TokEnabled,PinType,DeliveryMethod,DestinationAddress,TemplateFile
SSD,00xxxxxxx,1,Tokencode,SMTP,xxxxxx@xxxxxx.com,mailtempl.xml
Even though we used PinType in AMBA as Tokencode, it is asking for pin in the mobile application.
When i download the file from the security console using the same Soft token profile, it is not asking.
- Tags:
- Agent
- Agents
- Auth Agent
- Authentication Agent
- Community Thread
- Discussion
- Forum Thread
- RSA SecurID
- RSA SecurID Access
- SecurID
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same on my tests with 8.3.0.5.0
Looks like a bug. AM-32506
due to be fixed in 8.3 patch 6 (which may not get released...8.4 is expected to come first)
due to be fixed in 8.4 patch 1 (look for this one when released)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same on my tests with 8.3.0.5.0
Looks like a bug. AM-32506
due to be fixed in 8.3 patch 6 (which may not get released...8.4 is expected to come first)
due to be fixed in 8.4 patch 1 (look for this one when released)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Edward,
Will downgrading to 8.3.0.3 help us overcoming this issue?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Not sure when the defect started.
You can downgrade to a version where SSTDT worked with SSD and you do not define a profile, you define everything about the token inside the SSTDT directives.
Or maybe you can just swap to an older jar file**, and not downgrade the system, just set up a temporary 8.3.0.0.0 primary somewhere to copy it's AMBA jar file.
------------------
This example is what I mean. Deploy a pinless 8 digit software token that is already assigned to a user. This has zero to do with any software token profile, only the device type name and FamilyKey matters.
Action,Key,KeyType,Miscvariable
SSTDT,Android,FamilyKey,1.x
CIF,Action,TokSerial,PINType,TokEnabled,OTPLength,DeliveryMethod,DestinationAddress
SSD,000020735716,tokencode,1,8,SMTP,administrator@farmco.local
This will fail in the current version as the newest SSD requires a profile to be defined.
Some of it works, as part the underlying code is the same
-Entering CommandUtils.setSoftTokenDeviceType
Info : -Key: keyType = Value: FamilyKey
Info : -Key: Linenumber = Value: 2
Info : -Key: Action = Value: SSTDT
Info : -Key: MiscVariable = Value: 1.x
Info : -Key: key = Value: Android
<snip>
But then problems with SSD
-applyTokenSettings(...) - Key: Linenumber = Value: 4
Info : -applyTokenSettings(...) - Key: Action = Value: SSD
Info : -applyTokenSettings(...) - Key: DestinationAddress = Value: administrator@farmco.local
Info : -applyTokenSettings(...) - Key: PinType = Value: tokencode
Info : -applyTokenSettings(...) - Key: TokEnabled = Value: 1
Info : -applyTokenSettings(...) - Key: OTPLength = Value: 8
Info : -applyTokenSettings(...) - Key: DeliveryMethod = Value: SMTP
Info : -applyTokenSettings(...) - Key: TokSerial = Value: 000020735716
Failure: 2018-12-12 09:21:23 : Line 4 - singleSofttokenDeployment -Token 000020735716 not deployed. Reason: Software Token Profile is required to deploy software token
8.3.0.3.0 will also fail because this is where defining software token profiles by name started.
---
My csv example above, it may (should) work in 8.3.0.2.0 and earlier. The downside is that when you view the token it will have blank as a software token profile name since you are not defining a profile, you are building the whole token inside AMBA.
**You can try just replacing the /opt/rsa/am/utils/lib AMBA jar file with a version from 8.3.0.0.0 base, but I have never tested this swap.... and am not set up to do so. It's pretty harmless to test it, just rename the current jar to preserve a copy (AMBulkAdmin-8.3.0.5.0.jar-bak)
Bring over a copy from 8.3.0.0.0, and rename it to match the current version if you try it, then test my CSV example above...if it runs you should get pinless tokens.
/opt/rsa/am/utils/lib/AMBulkAdmin-8.3.0.5.0.jar (renamed from AMBulkAdmin-8.3.0.0.0.jar)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Edward,
The CSV example you have given is creating SDTID files and are sending via email. But this cannot be opened in windows PC. It says "device intended for this token not found. Token import failed.Connect the device or contact your administrator"
We were looking got a generic file that too with 6 digits token code length
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the deviceserialnumber directive needs to be added and
made to match the device serial number on the target, or made null.
below I make it null
original
Action,Key,KeyType,Miscvariable
SSTDT,Android,FamilyKey,1.x
CIF,Action,TokSerial,PINType,TokEnabled,OTPLength,DeliveryMethod,DestinationAddress
SSD,000020735716,tokencode,1,8,SMTP,administrator@farmco.local
new
Action,Key,KeyType,Miscvariable
SSTDT,Android,FamilyKey,1.x
CIF,Action,TokSerial,PINType,TokEnabled,OTPLength,DeviceSerialNumber,DeliveryMethod,DestinationAddress
SSD,000020735716,tokencode,1,8,0,SMTP,administrator@farmco.local
DeviceSerialNumber -2, -1, 0, value, empty
Attribute values:
-2- copy the TokSerial to the attribute value field.
-1- copy the DefLogin to the attribute value field
0- force attribute value field to empty (overrides any default)
value- copy value to the attribute value field (overrides any default)
empty- use Software Token Device Type value if one is declared
