Announcements

SecurID® Discussions

Browse the SecurID discussion board to get product help and collaborate with other SecurID users.
ASWINSASIDHARAN
Occasional Contributor
Occasional Contributor

Token code without PIN.

Jump to solution

Hi Team,
We are currently on the version 8.0.5.0
We tried distributing the soft token via AMBA. We created a soft token profile based on iOS 2.x.
Even though we have selected for "No Pin Code" (only token code), in the soft token application it is asking for a pin.

 

Below are the AMBA commands useed:


Action,SoftTokenProfile
SSTP,ios-special-1
CIF,Action,TokSerial,TokEnabled,PinType,DeliveryMethod,DestinationAddress,TemplateFile
SSD,00xxxxxxx,1,Tokencode,SMTP,xxxxxx@xxxxxx.com,mailtempl.xml

 

Even though we used PinType in AMBA as Tokencode, it is asking for pin in the mobile application.
When i download the file from the security console using the same Soft token profile, it is not asking.

Labels (1)
0 Likes
1 Solution

Accepted Solutions
EdwardDavis
Employee
Employee

Same on my tests with 8.3.0.5.0

 

Looks like a bug. AM-32506

 

due to be fixed in 8.3 patch 6 (which may not get released...8.4 is expected to come first)

due to be fixed in 8.4 patch 1 (look for this one when released)

View solution in original post

5 Replies
EdwardDavis
Employee
Employee

Same on my tests with 8.3.0.5.0

 

Looks like a bug. AM-32506

 

due to be fixed in 8.3 patch 6 (which may not get released...8.4 is expected to come first)

due to be fixed in 8.4 patch 1 (look for this one when released)

Hi Edward,

Will downgrading to 8.3.0.3 help us overcoming this issue?

0 Likes

Hello,

 

Not sure when the defect started.

 

You can downgrade to a version where SSTDT worked with SSD and you do not define a profile, you define everything about the token inside the SSTDT directives.

 

Or maybe you can just swap to an older jar file**, and not downgrade the system, just set up a temporary 8.3.0.0.0 primary somewhere to copy it's AMBA jar file.

------------------

This example is what I mean. Deploy a pinless 8 digit software token that is already assigned to a user. This has zero to do with any software token profile, only the device type name and FamilyKey matters.

 

Action,Key,KeyType,Miscvariable
SSTDT,Android,FamilyKey,1.x
CIF,Action,TokSerial,PINType,TokEnabled,OTPLength,DeliveryMethod,DestinationAddress
SSD,000020735716,tokencode,1,8,SMTP,administrator@farmco.local

 

This will fail in the current version as the newest SSD requires a profile to be defined.

 

Some of it works, as part the underlying code is the same

-Entering CommandUtils.setSoftTokenDeviceType
Info : -Key: keyType = Value: FamilyKey
Info : -Key: Linenumber = Value: 2
Info : -Key: Action = Value: SSTDT
Info : -Key: MiscVariable = Value: 1.x
Info : -Key: key = Value: Android

<snip>

But then problems with SSD

-applyTokenSettings(...) - Key: Linenumber = Value: 4
Info : -applyTokenSettings(...) - Key: Action = Value: SSD
Info : -applyTokenSettings(...) - Key: DestinationAddress = Value: administrator@farmco.local
Info : -applyTokenSettings(...) - Key: PinType = Value: tokencode
Info : -applyTokenSettings(...) - Key: TokEnabled = Value: 1
Info : -applyTokenSettings(...) - Key: OTPLength = Value: 8
Info : -applyTokenSettings(...) - Key: DeliveryMethod = Value: SMTP
Info : -applyTokenSettings(...) - Key: TokSerial = Value: 000020735716

Failure: 2018-12-12 09:21:23 : Line 4 - singleSofttokenDeployment -Token 000020735716 not deployed. Reason: Software Token Profile is required to deploy software token

 

8.3.0.3.0 will also fail because this is where defining software token profiles by name started.

 

---

 

My csv example above, it may (should) work in 8.3.0.2.0 and earlier. The downside is that when you view the token it will have blank as a software token profile name since you are not defining a profile, you are building the whole token inside AMBA.

 

**You can try just replacing the /opt/rsa/am/utils/lib AMBA jar file with a version from 8.3.0.0.0 base, but I have never tested this swap.... and am not set up to do so. It's pretty harmless to test it, just rename the current jar to preserve a copy (AMBulkAdmin-8.3.0.5.0.jar-bak)

 

Bring over a copy from 8.3.0.0.0, and rename it to match the current version if you try it, then test my CSV example above...if it runs you should get pinless tokens.

/opt/rsa/am/utils/lib/AMBulkAdmin-8.3.0.5.0.jar (renamed from AMBulkAdmin-8.3.0.0.0.jar)

Hi Edward,

The CSV example you have given is creating SDTID files and are sending via email. But this cannot be opened in windows PC. It says "device intended for this token not found. Token import failed.Connect the device or contact your administrator"

We were looking got a generic file that too with 6 digits token code length

0 Likes

the deviceserialnumber directive needs to be added and

made to match the device serial number on the target, or made null.

 

below I make it null

 

original

Action,Key,KeyType,Miscvariable
SSTDT,Android,FamilyKey,1.x
CIF,Action,TokSerial,PINType,TokEnabled,OTPLength,DeliveryMethod,DestinationAddress
SSD,000020735716,tokencode,1,8,SMTP,administrator@farmco.local

 

new

 

Action,Key,KeyType,Miscvariable
SSTDT,Android,FamilyKey,1.x
CIF,Action,TokSerial,PINType,TokEnabled,OTPLength,DeviceSerialNumber,DeliveryMethod,DestinationAddress
SSD,000020735716,tokencode,1,8,0,SMTP,administrator@farmco.local

 

 

 

 

DeviceSerialNumber -2, -1, 0, value, empty

 

Attribute values:
-2- copy the TokSerial to the attribute value field.
-1- copy the DefLogin to the attribute value field
0- force attribute value field to empty (overrides any default)
value- copy value to the attribute value field (overrides any default)
empty- use Software Token Device Type value if one is declared