Secure Mobile Access 12.4 Administration Guide

Download PDF
Technical Documentation > Secure Mobile Access 12.4 Administration Guide > Authentication > Network and Authentication Configuration > Managing User Authentication > Integration of SMA1000 with RSA SecurID Authentication Manager > Configuring RSA Server Authentication

Configuring RSA Server Authentication

The appliance supports SecurID, token-based user credentials that are validated against a database on an RSA Authentication Manager (Legacy) server. Configuring this type of authentication involves changes on both the RSA server and the SMA appliance, which are outlined below. Affinity servers should be used only for authentication servers that do not include full group search capabilities, such as RADIUS, RSA, and PKI servers.

If you are using the latest RSA SecurID Authentication Manager using the SecurID Authentication API, then you

can skip this section and go to Configuring the RSA SecurID Authentication Manager.

To configure RSA Authentication Manager for token-based credentials

  1. Create an agent host on the RSA server with the IP address for the internal interface of the SMA appliance.

  2. Make the configuration changes necessary to resolve the names of both the RSA server and the SMA appliance:

    • DNS must be able to resolve the RSA server’s name; simply adding the appliance and its IP address to your /etc/hosts file will not work.

    • The appliance’s name (as configured on the RSA server) must resolve to the internal IP address of the appliance.

  3. DNS must be able to resolve the RSA server’s name in both directions:

    • The appliance’s name (as configured on the RSA server) must resolve to the internal IP address of the appliance; simply adding the appliance and its IP address to your /etc/hosts file will not work.

    • The RSA server requires a reverse DNS entry for the internal interface of the SMA appliance.

  4. After adding the agent host on the RSA server, make sure that you generate the configuration file (sdconf.rec) for the correct agent host.

  5. In the AMC, navigate to System Configuration > Authentication Servers.

  6. Click New.

  7. Select RSA Authentication Manager (Legacy).

  8. In the Name field, type a name for the authentication server.

  9. Specify the location of your RSA Authentication Manager (Legacy) server SecurID configuration file, sdconf.rec. This configuration file is in binary format and contains the ports and processes associated with the RSA authentication service. When in place, this file is used by the RSA libraries to communicate over the network to an RSA server.

  10. Click Save to upload it to the appliance.

  11. The node secret is negotiated when the first authentication request is made from the agent host. Make sure that the node secret created flag is cleared on the RSA server.

    • If you make any changes to the RSA server (for example, change its IP address, host name, or re-install it), the sdconf.rec file must be uploaded to the appliance again.

    • After upgrading some older versions, users may not be able to authenticate through the RSA server because the node secret did not migrate properly. In this case, clear the node secret for the authentication agent on the RSA server.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden