Splunk integration with RSA Authentication Manager using REST API

[#1]

Article Number

000067941

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.2 SP1 or above

Issue

• This protects Splunk with RSA Authentication Manager.
• Setting up the REST API as an authentication agent.
• The REST API is very useful as it doesn't restrict you to a specific code or programming language.

Resolution

First, enable the REST API interface from the Security Console. (Note you must be running RSA Authentication Manager 8.2 SP1 or above to access this interface.)

1. Navigate to Setup > System Settings > RSA SecurID Authentication API.
2. Check the box to Enable Authentication API.
3. Note the values for the Access Key.
4. You can change the value for the communication port number to any free port.

5. Add an agent entry in the Security Console:
6. Select Access > Authentication Agents > Add New.
7. Add the agent name.  Any name will do, but note that it will be used as the clientId in the requests below.
8. Login to the Splunk server.
9. Navigate to /opt/splunk/etc/apps/<app_name>/local/authentication.conf:

cd /opt/splunk/etc/apps/<APP_NAME>/local

10. The <app_name> shall be the application used by Splunk. (e.g. launcher)
11. In case of launcher, it will be as below:

    
    cd /opt/splunk/etc/apps/launcher/local

12. Edit the authentication.conf file:

    
    vi authentication.conf

13. Fill in the following: 

    
    [rsa-mfa] 
    accessKey = <Access_Key_From_Security_Console>
    authManagerUrl = https://<Primary_RSA_Server_Hostname>:5555/ 
    clientId = <Agent_Name_Created_Above> 
    enableMfaAuthRest = 1 
    failOpen = 0 
    replicateCertificates = 1 
    sslRootCAPath = <Mention__The_Path_to_RSA_Console_certificate> (eg. $SPLUNK_HOME/etc/auth/rsa-2fa/cert.pem)
    timeout = 15 
    [authentication] 
    externalTwoFactorAuthVendor = rsa 
    externalTwoFactorAuthSettings = rsa-mfa 

14. After making the above changes, save the configuration file:
    1. Press ESC then type :wq! then press Enter.
15. Finally, restart the Splunk server

    
    /opt/splunk/bin/splunk restart 
    

Notes

To export the console certificate

1. Navigate to the Security console 
2. Export the certificate Base-64 encoded X.509 (.CER)