Cannot link the runtime identity source because no administrative identity sources reference this runtime source in RSA Authentication Manager

[#1]

Article Number

000016865

Applies To

RSA Product Set:  SecurID
RSA Product/Service Type:  Authentication Manager
RSA Version/Condition:  3.0, 7.1, 8.x

Issue

The following error displays when attempting to link an external identity source in Authentication Manager

Cannot link the runtime identity source because no administrative identity sources reference this runtime source

Cause

This error will display if the external identity source is defined as a global catalog (GC) in the Operations Console.  Systems need to have at least one administrative identity source mapped.  The GC can be used for run time (authentication/read-only), but it doesn't contain the attributes needed for administration.  For that we need to point to a domain controller (DC).  The way to do this is to create two identity sources, then associate the DC to the GC.
 

Resolution

Authentication Manager 8.x

• Create the identity source for the GC

1. Launch the Authentication Manager Operations Console and from the Home tab, select Manage Identity Sources > Add New Identity Source.
2. Create an identity source for the GC, defining the identity source basics and connection information.
3. Click on the Map tab.
4. Leave the User Base DN and User Group Base DN information blank.
5. Check the option that the directory is an Active Directory Global Catalog.
6. Complete the rest of the information on the page.
7. ​Click Save and Finish.

• Create the identity source for the DC

1. Launch the Auth Manager Operations Console and from the Home tab, select Manage Identity Sources > Add New Identity Source.
2. Create an identity source for the DC, defining the identity source basics and connection information using the same name and directory information as above.
3. Click on the Map tab.
4. Enter the User Base DN and User Group Base DN information.  The User Base DN and User Group Base DN entries should be the same.  To get all of your users, just enter top level of your domain such as dc=gizmo,dc=com.  This information can be modified later.
5. Uncheck the option that the directory is an Active Directory Global Catalog.
6. For the User Authentication option, select the option that users authenticate to a GC and select the proper GC from the drop down list. 
7. Complete the rest of the information on the page.
8. Click Save and Finish.

• Link identity source to system

1. From the Security Console, select Setup > Identity Sources > Link Identity Source to System.
2. The available identity sources are listed on the left. 
3. Select the source(s) to be linked.
4. Click the > button to move the source(s) to the Linked box.
5. Click Save.

Authentication Manager 7.1 and RSA SecurID Appliance 3.0

• Create the identity source for the GC

1. Launch the Authentication Manager Operations Console and from the Home tab, select Manage Identity Sources > Add New Identity Source.
2. Create an identity source for the GC, defining the identity source basics and connection information.
3. Click on the Map tab.
4. Leave the User Base DN and User Group Base DN information blank.
5. Set the directory to read only.
6. Check the option that the directory is an Active Directory Global Catalog.
7. Leave the default user group type as Universal.
8. Complete the rest of the information on the page.
9. ​Click Save and Finish.

• Create the identity source for the DC

1. Launch the Auth Manager Operations Console and from the Home tab, select Manage Identity Sources > Add New Identity Source.
2. Create an identity source for the DC, defining the identity source basics and connection information using the same name and directory information as above.
3. Click on the Map tab.
4. Enter the User Base DN and User Group Base DN information.  The User Base DN and User Group Base DN entries should be the same.  To get all of your users, just enter top level of your domain such as dc=gizmo,dc=com.  This information can be modified later.
5. Set the directory to read only.
6. Uncheck the option that the directory is an Active Directory Global Catalog.
7. For user authentication, define that users authenticate to a GC and select the GC from the drop down list. 
8. Complete the rest of the information on the page.
9. Click Save and Finish.

• Link identity source to realm

1. From the Security Console, select Administration > Realms > Manage Existing.
2. Click on the down arrow next to SystemDomain and choose Edit.
3. The available identity sources are listed on the left. 
4. Select the source(s) to be linked.
5. Click the > button to move the source(s) to the Linked box.
6. Click Save.

Notes

Configuring a DC is required if you want to have an external identity source, configuring a GC is optional in Authentication Manager.

Anecdotally, RSA support has found performance improvements with a GC when there are tens of thousands or hundreds of thousands of users authenticating.  For smaller deployments, implementing a GC does not improve authentication speed to a significant degree.