We want to consult you about a procedure we are trying to do. A client wants to do the diattachment of the license from their tokens in a automated kind of way. Is this even possible? There is a way to develope a script in order to do this? Please help me.
If you mean unassign tokens from a user so the license count drops by 1 number per user,
then AMBA (Auth Manager Bulk Admin) can script token unassignment easily:
Rescind Token
The token specified will be unassigned. No other action regarding this user or token is
performed.
| Action | RT |
| Required Fields | TokSerial |
| Optional Fields | None |
So, make an input csv file possibly named rt.csv
Action,TokSerial
RT,000020735720
this will unassign token 000020735720 from the owner. If this is the last
token the user has, and they are not enabled for on-demand and do not have a fixed passcode,
then the active user license count will drop by 1.
You can run a report to get a big list of token serial numbers, and output as CSV file, and make it
easier to develop a large input file for AMBA processing.
If you use the AMBA command UT (unassign token) then it can do the same thing, but, with UT... if this is
the last token the user has, it will also delete the user from the database. RT will attempt no user delete.
The client used software tokens but they started to buy hardware tokens to replace the soft ones. They want to take the licenses of the soft tokens to enable the hardware tokens in an automatic way.
a) Any user can have up to three tokens assigned at the same time, and it still only takes 1 off the license count.
You could just assign a lot of hardware tokens as new tokens to users, and later, go unassign the software tokens.
b) To mass distribute a lot of hardware tokens and have the end user log in and register the serial number of the token they received (this makes it easier to blast out tokens to user without needing to track serial numbers) you can use the 'one-from-the-bucket' method (doc for how to do this attached am_mass_HW_token_provisioning,pdf)
c) You can use the Security Console to assign replacement tokens up to 500 at a time (500 is max that can be seen and selected in a browser window on one page)
-or-
d) AMBA can script token replacement. Replace a software token with a hardware token, and the old software token keeps working the same, more or less indefinitely, until the user gets around to using the new hardware token for a login somewhere, with the same pin used for the old software token. The RSA server then will unassign the software token from the user. Old pin can be kept to make it easier, or you can force the new token to require a new pin.
Replace Token
The TokSerial field contains the token serial number of the token to be replaced and
must already be assigned to a user. The ReplTokSerial field contains the token serial
number of the token replacing TokSerial. The token specified by ReplTokSerial will
be assigned to the user as a replacement token
example: software token 000020735720 to be replaced by SID800 000159871817 and keep the pin intact
old software token keeps working, until the user uses the new token for the first time, then old token gets unassigned.
Action,TokSerial,ReplTokSerial,TokEnabled,PinMode
REPT,000020735720,000159871817,1,0
David Martinez,
Please provide more information on what your client is trying to accomplish so we can determine if it is possible.
Regards,
Erica