Enable system-generated PINs for RADIUS in RSA Authentication Manager 8.x

[#1]

Article Number

000032279

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x

 

Issue

On the token policy page there is an option to Require System-generated PIN. This works when generating a new PIN through standard agents. However you will get the following error in the Authentication Activity Monitor when trying to set a new PIN with RADIUS protocol:
 

New PIN cancelled for user

Resolution

For a RADIUS client, in addition to enabling the System-generated PIN option in the token policy, you need also manually edit the securid.ini file and change the AllowSystemPins value to AllowSystemPins = 1.

You can edit this file from Operations Console by navigating to Deployment Configuration > RADIUS Server or you can edit /opt/rsa/am/radius/securid.ini via SSH. 

From the UI

1. Login to the primary Authentication Manager Operations Console.
2. Select Deployment Configuration > RADIUS Servers > Edit RADIUS Server.
3. Click the drop down arrow on the primary Authentication Manager server and choose Manage Server Files.
4. Click on the drop down arrow next to the securid.ini file and choose Edit. 
5. Look for AllowSystemPins = 0. 
6. If the line is commented out with a semicolon, remove the semicolon.
7. Change the 0 to a 1.
8. When done, click Save & Restart RADIUS Server.  This restart allows the change to take effect.
9. From the primary's Operations Console, repeat steps 1 - 8 for each replica.

From an SSH session

1. Using 000038244 - SSH to an RSA Authentication Manager server, connect to the primary RSA Authentication Manager server.
2. Login to the primary server:

login as: rsaadmin
Using keyboard-interactive authentication.
Password: <enter operating system password>
Last login: Wed Dec 18 16:39:41 2019 from jumphost.vcloud.local
RSA Authentication Manager Installation Directory: /opt/rsa/am

3. Navigate to /opt/rsa/am/radius/securid.ini.
4. Open the securid.ini file in a text editor:

rsaadmin@am84p:/opt/rsa/am/utils> cd /opt/rsa/am/radius
rsaadmin@am84p:/opt/rsa/am/radius> vi securid.ini

5. Search for the text of AllowSystemPins = 0. 
6. Press i to enter Insert mode.
7. If the line is commented out with a semicolon, remove the semicolon.
8. Change the 0 to a 1.
9. Press Esc then type :wq! to save changes and close the file.
10. Navigate to /opt/rsa/am/server:

rsaadmin@am84p:/opt/rsa/am/utils> cd /opt/rsa/am/server

8. Restart the RADIUS server for the change to take effect:

rsaadmin@am84p:/opt/rsa/am/server> ./rsaserv restart radius

9. Open an SSH session to each replica and repeat steps 1 - 8.