This article describes how to integrate CrowdStrike Falcon Identity Protection with RSA Authentication Manager (AM) using RSA MFA API (REST).

Configure AM

Perform these steps to configure AM using the REST API.

Procedure

1. Install the CrowdStrike on-premise MFA enablement tool within your network.
2. Enable RSA SecurID Authentication API in AM administration console.
3. Set up an authentication agent in the AM administration console.

Configure CrowdStrike Falcon Identity Protection

Perform these steps to configure CrowdStrike Falcon Identity Protection.

  
Set up the CrowdStrike On-premise MFA Enablement Tool

To set up the CrowdStrike on-premise MFA enablement tool in your environment and enable MFA through on-premise providers, follow these steps:

1. Check the prerequisites.
2. Create an API client.
3. Install the CrowdStrike on-premise MFA enablement tool.

Integrate Identity Protection with AM

To integrate Identity Protection with AM, follow these steps:

1. Import the AM server certificate into the on-premise MFA enablement tool.
   1. Download a copy of the root server certificate file from the AM administration console. 
      For more information, see Download an RSA Authentication Manager Server Certificate in the RSA documentation.
   2. As a local administrator on the endpoint that is running the on-premise MFA enablement tool:
      1. In a command prompt, change directory to C:\Program Files\CrowdStrike Identity Protection\CrowdStrike On-premises MFA Enablement\jre64\bin.
         If you did not install the on-premise MFA enablement tool in the default directory, update the path as required.
      2. Run the following command: keytool -import -trustcacerts -keystore "C:\ProgramData\CrowdStrike Identity Protection\CrowdStrike On-premises MFA Enablement\cacerts_crowdstrike" -storepass changeit -alias <MyAlias> -file "<path/to/rsa_server_certificate.cer>".
         Specify the path to the CER file you downloaded from AM, and specify an alias to help you identify the certificate.
      3. Restart the on-premise MFA enablement tool service to start using the newly imported certificate.
2. Enable the SecurID authentication API in AM.
   1. As described in Configure the RSA SecurID Authentication API for Authentication Agents in the RSA documentation, enable the authentication API to allow the on-premise MFA enablement tool to access your AM instance.
   2. Make a note of the API Access Key value.
      You will use this value in the Authentication API Key property when configuring the connector.
3. Create an authentication agent in AM.
   1. As described in Deploying an Authentication Agent That Uses the REST Protocol in the RSA documentation, create an authentication agent to help you identify the source of authentication events when viewing RSA AM logs, and configure the connection port.
   2. Make a note of the Hostname value. Use this value in the Authentication API Agent Name property when configuring the connector.
   3. Make a note of the port number the authentication agent will use, often 5555. Use this value in the Port Number property when configuring the connector.
4. Configure the AM connector in the Falcon console.
   1. In the Falcon console, go to Identity Protection > Configure > Connectors.
   2. In the Select connector list, select RSA AM and click Add.
   3. Enter the values you obtained from AM in the following fields:
      • Domain (the domain name that hosts your AM server)
      • Port Number
      • Authentication API Key
      • Authentication API Agent Name
   4. (Optional) In the User Identifier section, select the attribute that contains the value the MFA provider requires to uniquely identify a user.
      For example, you might have your MFA provider configured to require the e-mail address or principal name.
      We recommend that you keep the Default setting.
   5. Click Save.
      The indicator turns green within a minute, indicating the connection was successfully established.
   6. If the indicator does not turn green:
      1. Refresh the page.
      2. Verify that the hostname is accessible.
      3. Verify that all the parameters are entered correctly. If not, re-enter the parameter and click Save.
   7. Test the connection by creating an identity verification policy rule for an AM MFA-enrolled user. Make sure to select the RSA AM option in the Connector list.

When attempting to log on to a workstation that is not associated with them, the user should receive an on-screen notification to perform MFA.

For more information, see Identity Protection Policy.

The configuration is complete.