client is using internal database to store users and tokens.
are there any pre-requisites i need to complete in target deployment before importing the users and tokens?
or is it simply export/import users and tokens?
Essentially, nothing special needs to be done other than make a backup, and make sure the target system license limit will allow that many new users to be able to authenticate.
One good idea is always import to a system of equal or higher version.
If sending to internal database, just import. It will only import unique names (do not already exist on target).
If the target system has the users (userid, first name and last name) in an external ldap identity source, then each user needs to be not already registered on the target.
When you make an initial connection to ldap, and now have a list of users you can assign tokens to, none of these users are yet 'registered'. The RSA database has no special data stored in the database about them. If you edit any user or make a note, or otherwise do any action to cause the RSA database to store data and make a GUID for them (assign tokens, or any admin action) then the import will not allow import of a duplicate userid if they are registered, it will only import those who are not yet registered. Forcing an identity source cleanup can unregister any user or users.
Nearly all import jobs have some type of warning message. In order to see what any warnings are about, you need to run a report: Imported Users and Tokens Report, which will show line-by-line how each incoming user and token was handled.
Make a backup first, so if anything goes sour, you can restore back to the pre-import condition, and then fix whatever situation caused a problem, and try again.
If you wanted to 'see' the registered users that Ed is talking about in the RSA internal database have a look at https://community.rsa.com/docs/DOC-45944
Which has the SQL command to look at user, and see how the internal database has a field called exuid that points to the actual user in LDAP, typically with the value of their ObjectGUID from AD.
Retrieving data ...