Repair a Trust Relationship with a Version 8.0 or Later Realm

If you restore the RSA Authentication Manager 8.7 SP1 primary instance on a machine with a new hostname, and you had a trust relationship previously with another version 8.0 or later realm, perform the following procedure to repair the trust between the two Authentication Manager deployments.

Note: You can also repair a trust relationship between RSA Authentication Manager and SecurID . For instructions, Repair an SecurID Trusted Realm.

Before you begin

The administrator of the restored deployment and the administrator of the deployment where the trust will be repaired must be able to communicate directly while they perform this procedure.

Procedure

  1. The administrator of the restored deployment performs the following steps to generate a trust package.

    1. In the Security Console, click Administration > Trusted Realms > Manage Existing.

    2. Under Trusted Realm Name, click the trusted realm name to repair.

    3. From the context menu, click Generate Trust Package, and save the file (TrustPackage.xml).

    4. After the trust package is saved, use a secure method to send the trust package to the administrator of the deployment where the trust will be repaired.

  2. The administrator of the deployment where the trust will be repaired performs the following steps to import the trust package.

    1. After receiving the trust package, click Administration >Trusted Realms > Manage Existing.

    2. Under Trusted Realm Name, click the trusted realm name to repair.

    3. From the context menu, click Repair Trust.

    4. In the Trust Package from Trusted Realm field, enter the path to the new trust package by browsing to the package file, and click Open.

    5. Click Next, and contact the restored realm administrator.

  3. The administrator of the restored deployment performs the following steps to share the confirmation code with the administrator of the deployment where the trust will be repaired.

    1. In the Security Console, click Administration > Trusted Realms > Manage Existing.

    2. Under Trusted Realm Name, click the trusted realm name to repair.

    3. From the context menu, click View, locate the confirmation code under Current Realm Confirmation Code, and read the code to the administrator of the deployment where the trust will be repaired to confirm that the trust package is valid.

      The Current Realm Confirmation Code must match the administrator’s Trusted Realm Confirmation Code.

  4. The administrator of the deployment where the trust will be repaired performs the following steps to repair the trust.

    1. On the Update Trusted Realm page under Trusted Realm Confirmation Code, read the Trust Package Confirmation Code to the restored realm administrator to confirm that the trust package is valid.

      The Trusted Realm Confirmation Code must match the restored realm administrator’s Current Realm Confirmation Code.

      If the confirmation code does not match, ask the restored realm administrator to generate and send a new trust package.

    2. Click Confirm and Next.

    3. (Optional) For Authentication Status, select Authenticate Trusted Users if you want your realm to authenticate users from the trusted realm.

    4. For Create Trusted Users in Security Domain, select the security domain that will own users from the trusted realm.

      After your realm authenticates users from the trusted realm, the users must belong to a security domain in your realm. The security domain that you select must be configured to use the internal database as an identity source.

    5. (Optional) In the Trusted User Name Identifier field, enter a unique identifier that your realm can recognize for the trusted user, and click Add. The unique identifier could be the user's domain name or e-mail address, such as jsmith@company.com. The value must be unique among trusted realms.

      For example, suppose John Smith from Realm A is jsmith in his local realm. Your realm does not know the identity of jsmith. If you enter yourcompany.com in this field, this user will be identified within your realm as jsmith@yourcompany.com.

    6. Click Save.

  5. Restart the AM services on the restored deployment to view the latest configuration in the Security Console.

Related Concepts

Trusted Realms