High Availability OTP

If Cloud Access Service (CAS) cannot be reached because the connection is temporarily unavailable or too slow, RSA Authentication Manager can use downloaded High Availability OTP records to prompt users for Authenticate Tokencode.

 

When High Availability OTP is enabled, users who authenticate with methods supported by the RSA Authenticator app, such as Approve and Device Biometrics, are prompted for an Authenticate Tokencode or RSA SecurID passcode.

To use this feature, you must have one of the following connections:

• A direct connection between AM 8.5 or later and CAS

• A connection that uses the embedded identity router in AM.

You must enable High Availability OTPs in CAS. For instructions, see Configure High Availability OTP.

Note:  
1. High Availability OTP is available only for applications that connect to AM. It is not available for applications that connect directly to CAS or identity routers (IDRs), such as Entra ID integrations, SAML federation configured directly on CAS, applications that call CAS APIs directly, My Page SSO Portal, Relying Party, IDR RADIUS, or IDR SSO Portal. High Availability OTP supports RADIUS authentication in a hybrid deployment, but not in a CAS-only deployment.
2. SecurID OTP authenticators assigned to users in CAS (for example, SecurID 700 or DS100) can be used even when High Availability OTP is not enabled in the Cloud Administration Console.

 

How High Availability OTP Works

When you configure High Availability OTPs, AM automatically downloads High Availability OTP records for each user who has registered an RSA Authenticator app with CAS.

 

Authentication Manager licensing

Enabling High Availability OTP does not affect license usage in AM. For more information about how AM uses High Availability OTP records, see Configure High Availability OTP.

 

Behavior When CAS Is Not Available

Authentication behavior depends on whether the application connects to AM or directly to CAS. The following table describes the behavior for each integration. During a CAS outage, SecurID agents, RADIUS authentication in a hybrid deployment, and applications that use AM APIs can continue to authenticate through AM.

 

Integration	Behavior when CAS is unavailable
ADFS agent configured with an AM URL and a CAS access policy	AM runs the CAS health check periodically or immediately after the first error accessing CAS. If CAS is unavailable, AM switches to high availability mode and handles supported authentication locally.
RADIUS authentication in a hybrid deployment	High Availability OTP is supported for RADIUS authentication.
RADIUS authentication in a CAS-only deployment	High Availability OTP is not supported for RADIUS authentication. No fallback is available during a CAS outage.
SecurID agent authenticating through AM	High Availability OTP is supported in a hybrid deployment. During a CAS outage, AM handles authentication locally.
Application using AM APIs for local authentication	Applications using AM APIs are unaffected by CAS outages. During a CAS outage, AM handles authentication locally.
Application calling CAS APIs directly	AM High Availability OTP does not cover applications that call CAS APIs directly. No fallback is available when CAS is unavailable.
SAML federation configured directly on CAS	AM High Availability OTP does not support SAML federation configured directly on CAS. Authentication is unavailable until CAS is restored.
Entra ID integration with CAS	AM does not support Entra ID integration. Entra ID integrates directly with CAS, so AM High Availability OTP does not provide fallback during a CAS outage.

 

When CAS is not available, the following events occur:

• Users who normally use Authenticate Tokencode, Approve, or Device Biometrics are prompted for an Authenticate OTP or RSA SecurID passcode.

• The access policy in CAS is not applied.

• The AM lockout policy determines how many failed logon attempts users can make before their accounts are locked and whether accounts can be unlocked automatically or by the administrator.

• AM determines whether a user is enabled, disabled, or locked.

After the connection becomes available again, AM resumes authentication using CAS.

AM does not send updated authentication or user status information to CAS. CAS obtains user status information from the identity source.

 

Background Maintenance

Most High Availability OTP processing occurs automatically and does not require administrative tasks.

• AM monitors CAS to determine whether it is reachable and whether High Availability OTP records are needed. AM records this information in log files.

• A batch job called Authenticate Tokencode Sync Job automatically updates High Availability OTP records at the same time each day. RSA automatically assigns each customer deployment a synchronization time between 1:00 AM and 5:00 AM local time. Configuration is not required. The total number of processed records is recorded in the System Activity monitor and log files.