Quick Setup Guide - Connect Authentication Manager to Cloud Authentication Service

• What You Need to Have

• Generate the registration code and URL for Connecting AM to CAS

• Connect AM to CAS

• Download and Install Embedded Identity Router or Install a Standalone Identity Router

• Configure Identity Router

• Connect CAS to AM

• Add the Same Identity Source to CAS (External) or Add an Internal Identity Source

• Synchronize the Identity Source

• Register an Authenticator

• Configure the Agent to Use Modern MFA Methods

• Test Authentication

• What to Do Next

What You Need to Have

What You Need to Know

RSA uses a hybrid architecture that consists of two components:

• The Cloud Authentication Service, which provides an easy-to-use Cloud Administration Console and a powerful identity assurance engine.

• An identity router that does the following:

  • Connects the Cloud Authentication Service to your identity sources.

  • Sends authentication requests to the Cloud Authentication Service for validation.

  • Enforces access policies to determine which applications users can access, when additional authentication is needed, and which authentication methods are required.

Note:  The embedded IDR management subnet interface uses the internal IP range 172.17.0.1/16, and the embedded IDR docker subnet interface uses the internal IP range 172.19.01/16. These IP addresses are used by default by Authentication Manager when the embedded IDR is configured on Authentication Manager.

Add your values to the following worksheet. You will use this information later.

Connectivity Requirements

Replace the values in the table below with your values from the table above. This table identifies the connectivity requirements that you might need to provide to your IT group to update firewall rules for your network. Update your connectivity settings before continuing with the next step.

If RSA Authentication Manager is behind an external firewall that restricts outbound traffic, you must Configure a proxy server as given below.

Note:  RSA Authentication Manager only supports HTTP-basic authentication for proxy servers.

Procedure 

1. In the Security Console, click Setup > System Settings.

2. Click RSA Cloud Authentication Service Configuration.

3. Under RSA Cloud Authentication Service Firewall Proxy Configuration, click Enable Proxy Configuration.

4. In the Proxy Host field, enter the hostname of the proxy server. For example, example.com. If you have an HTTP proxy server that does not require a certificate, you can enter either a hostname or an IP address.

5. In the Proxy Port field, enter the port used by the proxy server.

6. If the proxy server does not require credentials, leave these fields blank. Otherwise, enter the following:

   1. In the Proxy Username field, enter the unique username for the proxy server.
   2. In the Proxy Password field, enter the unique password for the proxy server.

7. (HTTPS proxy server only) If you make changes to an HTTPS proxy server, a new Registration Code and Registration URL is required. You must connect to the Cloud Authentication Service again and accept a new certificate.

   This step does not apply to HTTP proxy servers.

   To connect again, do the following:

   1. Under Register RSA AM with the RSA Cloud Authentication Service, copy and paste the Registration Code and the Registration URL from the Cloud Administration Console, or obtain this information from a Cloud Authentication Service Super Admin and manually enter it.
   2. Apply the changes to the HTTPS proxy server by clicking Connect to the RSA Cloud Authentication Service. Saving the changes on the page does not update the connection.
   3. You are prompted to trust a proxy server certificate. Verify the certificate with your help desk or network administrator, and click Yes.

      The trusted proxy server certificate cannot be deleted in AM. You can replace the certificate by updating the proxy server connection or by connecting to a new proxy server, and then connecting to the Cloud Authentication Service again.

   4. Restart the proxy server.

   The proxy server information that you enter automatically updates the connection information for the Telemetry service that sends telemetry data to RSA. For more information, see Configure the Telemetry Service.

8. Click Save.

Generate the registration code and URL for Connecting AM to CAS

To connect Authentication Manager (AM) to RSA Cloud Authentication Service (CAS), you must first generate a registration code and URL from Cloud Administration Console and then copy them to AM.

1. Log in to the Cloud Administration Console of your CAS tenant.

2. From Platform, click Authentication Manager.

3. Under Connection from Authentication Manager, do the following:

   1. Choose an appropriate access policy, and then click Generate Code.
      

   2. Copy the Registration Code and Registration URL to the RSA Security Console.
      

   3. To enable high availability, click Enable under High Availability OTP.
      

   4. Click Publish Changes.
      

Connect AM to CAS

1. From RSA Security Console, go to Setup > System Settings.

2. From Authentication Settings, click RSA Cloud Authentication Service Configuration

   

3. Under Register RSA Authentication Manager with RSA Cloud Authentication Service, enter the Registration Code and Registration URL copied from CAS.

   

4. Click Connect to the RSA Cloud Authentication Service.
   

To install standalone IDR, refer to the Standalone IDR Quick Start Guide (QSG). After completing the IDR installation and configuration, proceed to "Configure the Agent to Use Modern MFA Methods".

Download and Install Embedded Identity Router

1. From RSA Security Console, go to the Home tab.

2. Under Quick Links, click Configure the Embedded Identity Router.
   
   

3. Under RSA Cloud Authentication Service Configuration, click Download & Install Identity Router.

   

4. The system downloads and installs the identity router image automatically.

You can also choose to install a standalone IDR. For more details, see Install a Standalone Identity Router.

Configure Identity Router

After installing the identity router, you need to configure it.

1. From RSA Security Console, go to Setup > System Settings.

2. From Authentication Settings, click RSA Cloud Authentication Service Identity Router.

3. Under RSA Cloud Authentication Service Identity Router, click Configure Identity Router.
   
   

4. Log in to the Identity Router. The credentials for initial login are:

   Username: idradmin

   Password: s1mp13.

   Note:  It is recommended to change the password when prompted.

5. To register the identity router, do the following:

   1. From the Cloud Administration Console, go to Platform, and click Identity Routers.

   2. Click Add an Identity Router.

   3. On the Basic Information tab, select the platform as Authentication Manager, type a name for the platform, and then click Save and Next Step.
      

   4. Click the Registration tab to view the registration details.

      

6. Copy the Registration Code and Authentication Service Domain to the identity router configuration page of RSA Security Console.
   

7. Click Submit and ensure that the registration is completed.

8. Navigate back to the CAS Identity Router page and ensure the IDR status is changed to Active.

9. On the CAS console, click Publish Changes.
   For more information on configuring the Identity Router, see RSA Community.
   

Connect CAS to AM

To use SecurID as an authentication method, the Super Admin for CAS must connect the CAS deployment to the AM server. These configuration settings allow all identity routers to communicate with AM.

Procedure

1. In the Security Console, click Access > Authentication Agents > Add New.

2. Under Authentication Agent Basics, enter a name into the Hostname field. For example: identityrouters.

   

3. Click Save.

4. Click Yes, Save Agent.

5. In the Cloud Administration Console, click Platform > Authentication Manager.

6. Click Configure Connection.

   

7. In the Authentication Agent Name field, enter the agent name that you created in step 2.

8. To upload the sdconf.rec file, click Choose File and select the file.

9. Click Save.

   

10. Click Publish Changes to apply the settings to all identity routers in the deployment. You must publish before you test the connection, but remember that publishing applies these settings and all pending changes to all identity routers.

11. Click Test Connection. A graphic shows the connection status for each configured identity router. If any components are not connected, investigate the cause.

After you finish

The Super Admin for the Cloud Authentication Service must make sure assurance levels and access policies are configured to require SecurID Token where appropriate.

Add the Same Identity Source to CAS (External)

You must connect both Authentication Manager and CAS to the same identity source for hybrid authentication.

1. From Cloud Administration Console, go to Users > Identity Sources.

2. Click Add Identity Sources and then select an identity source.

   Note:  For hybrid authentication, ensure you connect CAS to the same identity source that Authentication Manager is connected to.
   

3. Fill the Basic Information and Connection Settings.
   Basic Information:
   

   Connection Settings:

   
   

4. Under Directory Servers, click ADD.

   
   

5. Add the directory server details and then click Save.
   
   

6. Click Test Connection to verify if the configuration works. If the connection is successful, click Next Step.

   
   

7. Click Refresh Attributes and then click Next Step until you reach Save and Finish.

8. Click Publish Changes.
   
   

If you have completed adding an identity source (external), skip the below section and continue withSynchronize the Identity Source.

Add an Internal Identity Source

You can choose to connect Authentication Manager internal database identity source from Cloud Authentication Service(CAS) or from Authentication Manager.

RSA Authentication Manager Internal Database Identity Source

CAS has the capability to utilize users stored in a single AM server's internal database as an identity source. While users can only be managed within the AM database, passwords can be bi-directionally synced and managed either in AM or CAS.

In the AM Security Console, when users are fully synchronized from internal database to CAS, a new "RSA Authentication Manager Internal Database" identity source will be created automatically in CAS. For more information, see the "User Synchronization" section in Chapter 6: Deploying Cloud Authentication in RSA Authentication Manager 8.7 SP2 Administrator's Guide. Only one identity source of this type can be configured per CAS tenant.

CAS allows users to change or reset their passwords, and their passwords are synchronized back to AM.

Procedure 

1. In the Cloud Administration Console, click Users > Identity Sources.
   
   

2. Click Edit next to the "RSA Authentication Manager Internal Database" identity source.

3. By default, in the Identity Source Name field, the Authentication Manager’s hostname will be used as the default name for the "RSA Authentication Manager Internal Database" identity source cannot be edited.

4. (Optional) In the Description field, enter a description for the identity source.

5. In the Password Type section, select one of the following options:
   

   1. RSA Authentication Manager Server (synced to CAS) option if you want users to use their synced passwords from Authentication Manager to CAS for authentication in any sign-in page, and the Cloud Authentication Service stores and validates their passwords. By default, this option is selected. Select if the RSA Password from is Required or Allowed.

   2. No Password if you want an identity provider to authenticate users. In this case, the Cloud Authentication Service does not store or validate users' passwords. For information about configuring an identity provider, see Adding Identity Provider.
      

    

Data from the Internal Database

AM provides an internal database where you can create users and user groups. For users and user groups in the internal database, administrators can use the Security Console to do the following:

• Add, modify, and view user and user group data.

• Enable or disable AM functions, such as ODA and RBA, for individual users, including users whose accounts are in an LDAP directory.
  
  

Synchronize the Identity Source

1. From Cloud Administration Console, go to Users > Identity Sources.

2. Locate the identity source that you want to synchronize, click the arrow next to Edit, and select Synchronization.
   
   

3. Click Synchronize Now. The system synchronizes the identity sources.

Register an Authenticator

For Administrators

1. From Cloud Administration Console, go to Users > Management.

2. Search for and select the user to assign an authenticator.

3. Under Registration Code:

   1. Select an authenticator.
      
      

   2. Click Generate Code and provide the user with the generated code, organization ID, and Email ID.

For Users

• The user must install the RSA Authenticator and then add an OTP credential by entering the details provided by the admin.
  

You can proceed with agent configuration and testing authentication from here, if you have installed standalone IDR.

To install and configure the agent, follow the instructions provided in RSA MFA Agent 2.3 for Microsoft Windows Installation and Administration Guide, or consult previous versions.

Configure the Agent to Use Modern MFA Methods

To configure the RSA MFA Agent installed on the Windows machine, do the following.

1. Navigate to Local Computer Policy > Computer Configuration > Administrative Templates > RSA Desktop > RSA Settings.
   

2. Open Cloud Authentication Service Access Policy, add the access policy, and then click Apply.
   

3. Restart the RSA MFA Agent Service.

Test Authentication

Now that the configurations are complete, the users can use the modern authentication methods such as push notification, Approve, OTP and so on as configured in the CAS Access Policy by the Administrator.

1. Log in to the protected application such as, a computer or an application.

2. RSA sends a notification to your device as configured in the CAS Access Policy by the Administrator.

3. Respond to the notification. For example, if the notification is an Approve, tap Approve.
   

What to Do Next

To get MFA experience and High Availability(HA), administrators can setup MFA experience for AM users by referring to:

• Cloud Authentication Service Integration

• Authenticators Managed in the Cloud

• High Availability Tokencodes

• RSA Authentication Manager as a Proxy Server to the Cloud

Users can manage their authenticators and access applications by referring to:

• My Authenticators

• My Applications