Enable On-demand Authentication by both SMS and E-mail on RSA Authentication Manager 8.6 Patch1 and above

[#1]

Article Number

000039962

Applies To

RSA Product Set: SecurID Access
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.6 P1

Issue

This article explains how on-demand tokencodes can be delivered both via SMS text messages and e-mail, instead of allowing only one method per user. You configure this feature by running a command-line utility (CLU) and adding e-mail delivery to the SMS configuration option for on-demand tokencodes.

RSA Authentication Manager 8.6 P1 and above supports this enablement. 

Task

Enable On-demand Authentication by Both SMS and E-mail.
A command-line utility (CLU) adds the Add Delivery by E-mail checkbox on the SMS Configuration tab.

Image description

Before you begin
• Obtain the rsaadmin operating system password.
• You must be an Operations Console Administrator.

Procedure
1. Log on to the appliance using an SSH client.
2. When prompted, enter the operating system User ID, rsaadmin, and the operating system account password.
3. Change directories to /opt/rsa/am/utils:

cd /opt/rsa/am/utils

4. Run the following command-line utility (CLU):

./rsautil store -a update_config auth_manager.sms.smtp.feature.enabled true GLOBAL BOOLEAN

5. When prompted, enter your Operations Console administrator user ID and password.

login as: rsaadmin
Using keyboard-interactive authentication.
Password:
Last login: Tue Nov 23 08:12:42 2021 from 192.168.20.100
RSA Authentication Manager Installation Directory: /opt/rsa/am
rsaadmin@am86p:~> cd /opt/rsa/am/utils
rsaadmin@am86p:/opt/rsa/am/utils> ./rsautil store -a update_config auth_manager.sms.smtp.feature.enabled true GLOBAL BOOLEAN
Please enter OC Administrator username: <enter Operations Console admin's name>
Please enter OC Administrator password: <enter Operations Console admin's password>
psql.bin:/tmp/4269ce06-a736-4539-9ea2-02f956b8e8a98168679395019922515.sql:167: NOTICE:   Changed the value of configuration parameter 'auth_manager.sms.smtp.feature.enabled' from 'false' to 'true' for the instance 'GLOBAL'.
 update_config
---------------

(1 row)

rsaadmin@am86p:/opt/rsa/am/utils>

6. Flush the cache.
a. In the Operations Console, click Maintenance > Flush Cache.
b. If prompted, enter your Super Admin User ID and password, and click OK.
c. Select Flush all cache objects and click Flush.

Resolution

Add E-mail to the SMS Delivery Option.
On the primary instance, you can select the Add Delivery by E-mail checkbox on the SMS Configuration tab. You can remove the e-mail option from SMS by clearing the checkbox.

Procedure
1. In the Security Console, click Setup > System Settings.
2. Click On-Demand Tokencode Delivery.
3. On the SMS Configuration tab, select the Add Delivery by E-mail checkbox to deliver tokencodes by both SMS and e-mail.
4. Click Save.

Image description

After you select the Add Delivery by E-mail checkbox on the SMS Configuration tab, when you use the Security Console to select the delivery method for a user, you can choose SMS to send both a text message and an e-mail. You can locate users with the Authentication > On-Demand Authentication > Enable Users menu or in the User Dashboard.

Image description

Users who request on-demand tokencodes in the Self-Service Console can select from the methods you configure (SMS text message or e-mail).

Image description

After you select the Add Delivery by E-mail checkbox in the security console, users who select SMS receive an SMS text message and an e-mail.

Notes

• Refer Send On-Demand Tokencodes with Both SMS and E-mail from RSA Authentication Manager 8.6 Patch 1 Readme
• E-mail delivery requires a configured e-mail (SMTP) server and a user e-mail address if the user selects Mobile Number (SMS) as the preferred option for on-demand authentication.
• More information about Flush cache