Using powershell to modify hardware tokens for users.

[Willougd]

Hi,  

I am completely new to RSA authentication manager integrations.  We would like to via RESTAPI or Powershell, to update / change / assignment of preloaded hardware tokens for end users.  

I believe the two classes below from the API documentation will do what I want, but the parameters don't make sense to me to get started. 

I've done RESTAPI calls and I enabled the API interface with the token.  I'm just missing a place to get started.

Class LinkTokensWithPrincipalCommand

Class UnlinkTokensFromPrincipalsCommand

[EricaChalfin]

@Willougd,

Welcome to the RSA community! We are glad you've joined us. Thank you for your questions about Authentication Manager. 

You say you are looking to use the REST API or PowerShell to update/change the assignment of hardware tokens for your end users. Can you be a bit more descriptive of what you are looking to accomplish?

Our MFA agents for macOS and for Windows use the Cloud Authentication Service and Authentication Manager to provide strong multifactor authentication (MFA) to users authenticating through agents, both online and offline. If you are looking to simplify the bulk administration of users, tokens and agents, consider implementing the RSA Authentication Manager 8.7 Bulk Administration Utility. Please note AMBA does require a standalone license, the Cloud Plus license, or the Cloud Premier license. You can discuss licensing with your RSA sales representative.

While PowerShell can be installed and run on Linux distros, we do not recommend installing any additional software on your Authentication Manager server.

[Willougd]

Hi @EricaChalfin 

Right now, if we want to change who a hardware token is assigned to, someone has to login to the AM appliance and change the assignment.

I would like to develop an API via powershell to change who a hardware token is assigned to.  I can do 99% of it myself, I'm just not sure where to begin.  I haven't found any starter code that describes the APIs or anything like that.  

[SeanDoyle · Accepted solution]

the AM admin SDK is not a REST API. There is only a REST API for authentication.

There is a REST API for administration available from RSA Professional Services known as Prime which provides REST API middleware and API encapsulation of the AM admin SDK. The is not free and requires licensing and implementation support. 

In lieu of purchasing a Prime license and implementing it within your environment, your best option if you want to use Powershell is probably the AM SDK SOAP interface. This will take some work. Another alternative, still complicating but probably more doable would be to use the AM SDK Java API. All of these are in the AM Extras package.