New PINs and On-Demand Tokencodes for Authentication Agents and RADIUS Clients
On-demand tokencodes always require a PIN. As a result, an administrator cannot clear the PIN of a user with an on-demand tokencode without assigning a temporary PIN. The user experience of changing the PIN of an on-demand tokencode depends on the method used to request the tokencode.
For a tokencode requested through an authentication agent or RADIUS client:
The user attempts to access a protected resource, and the agent prompts the user to enter a User ID and passcode.
When prompted for the passcode, the user enters the current PIN, which could be an expiring PIN or a temporary PIN assigned by the administrator.
The agent prompts the user to enter a new PIN and to confirm the new PIN.
The user enters a new PIN and confirms the new PIN.
The agent prompts the user to enter a passcode.
The user enters the new PIN.
AM sends the on-demand tokencode to the user.
When the agent prompts the user for next tokencode, the user enters the received on-demand tokencode.
Related Articles
Checking name resolution and port connectivity for Web Tier instance on a supported Red Hat platform - RSA Authentication … Number of Views How to verify NTP server synchronization is not working in RSA Authentication Manager 8.x Number of Views RSA Governance & Lifecycle 8.0.0 Installation Guide Number of Views Quick Setup Guide - Connect Authentication Manager to Cloud Access Service with an Embedded Identity Router Number of Views RSA SecurID Access O365 WS-Fed Authentication Fails Intermittently Number of Views
Trending Articles
RSA Authentication Manager 8.9 Release Notes (January 2026) Quick Setup Guide - Passwordless Authentication in Windows MFA Agent for Active Directory RSA Authentication Manager Upgrade Process Authentication Manager Security Console and Operations Console Inaccessible After Certificate Update How to 'Trust' the RSA Authentication Manager Security Console Self-Signed Root CA certificate and prevent Cert warnings.
