RSA Authentication Agent 8.6 API does not prompt for passcode with Epic Hyperspace 2016 on Windows Server

[#1]

Article Number

000035189

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent API
RSA Version/Condition: 8.5, 8.6

Issue

Using the RSA Authentication Agent 8.6 API with Epic Hyperspace 2016 on a Windows Server with a configured agent and an edited rsa_api.properties file, but the prompt for RSA logon passcode does not display.  When a prescription or controlled drug is ordered, it should prompt for RSA passcode with the familiar gray RSA box, but that never shows, so the end user cannot logon.

Cause

There is a mistake in the rsa_api.properties file, usually a path to a non-existent or misspelled folder or directory.
 

An older version of this problem might have been caused by not copying the aceclnt.dll and the sdmsgs.dll to the Windows Server with the Agent API 8.5 or 8.6, such as Epic Hyperspace.

Resolution

1. Find the spelling mistake in the rsa_api.properties file.  The rsa_api.properties file contains entries such as:

RSA_AGENT_NAME = <hostname>
SDCONF_LOC = C:\ProgramData\Epic\RSA\sdconf.rec
RSA_LOG_FILE_LOC = C:\scripts\Log

The sharp (#) in front marks the line not parsed or is a comment.

2. If there is a spelling mistake or a path is wrong or non-existent, the RSA passcode prompt does not display, so you have to find the mistake.  One easy trick is to comment out lines with the # until the RSA prompt finally displays.  For example, if the following entry for SysWOW64 is in the file, but you are on a 32-bit system, \Windows\SysWOW64 does not exist, and will prevent the RSA prompt from displaying, so comment this line out as a test.  Change from:

RSA_BSAFE_LIBRARY_PATH = C:\Windows\SysWOW64

to 

#RSA_BSAFE_LIBRARY_PATH = C:\Windows\SysWOW64

3. When done, save the changes and test.
4. Repeat steps above until the passcode prompt displays.

Notes

The RSA Ready Implementation Guide for Epic Hyperspace 2016 instructs to:

1. Copy the following files to C:\Program Files (x86)\Epic\v8.3\Shared Files:

• aceclnt.dll
• aceclnt_tcp.dll
• ccme_asym.dll
• ccme_base.dll
• cryptocme.dll
• cryptocme.sig
• sdmsg.dll
• xeres-c_3_1_vc80.dll

2. Add RSA_BSAFE_LIBRARY_PATH = C:\Program Files (x86)\Epic\v8.3\Shared Files to the rsa_api.properties file.

One customer was using Citrix VDI desktops to deploy their Epic Hyperspace servers, but these were 32-bit VDIs, and did not have a C:\Program Files (x86)\Epic\v8.3\Shared Files, so this line was the cause of the missing RSA prompt, and needed to be customized in this case to C:\Program Files\Epic\v8.3\Shared Files

Also, because these VDIs were deployed in large numbers from a standard or gold image, the gold image commented out the #RSA_AGENT=<hostname> even though the implementation guide said to change it to the FQDN.  However autoregistration worked with TCP to read the system FQDN and use that for logging and to register.