Quick Setup Guide - Connect Governance & Lifecycle to Cloud Access Service

This guide helps you to connect the RSA Governance & Lifecycle (G&L) instance to the RSA Cloud Access Service (CAS) server and establish a trust relationship between them, enabling subsequent bi-directional integrations.

• What You Need to Have

• Generate the Registration Code and URL to Connect G&L to CAS

• Connect G&L to CAS

What You Need to Have

You need to have the following details:

• Registration Code

• Registration URL
  

Generate the Registration Code and URL to Connect G&L to CAS

You need a registration code and URL to enter into the G&L instance to establish the connection between G&L and CAS. To generate this code and URL, perform the following steps.

Procedure 

1. In the Cloud Administration Console, click Platform > Governance & Lifecycle.

2. Click Generate Code.
   The Registration Code is generated.

3. Copy the values from the Registration Code and URL fields and save them securely on your computer.

4. (Optional) Select a Network Zone from the drop-down list.

Connect G&L to CAS

You need to connect a G&L instance to the CAS server to establish a bi-directional trust relationship. To connect them, perform the following steps.

Procedure 

1. Log in to RSA Governance and Lifecycle.

2. Navigate to Admin > IDPlus Connect, and then click Create IDPlus Application.

3. On Page 1 (Help page), click Next.

4. On Page 2 (Register RSA G&L with RSA Cloud Authentication Service), enter the following details:

   • Application Name: Provide a name for the CAS server that you are connecting to.

   • Registration URL: Paste the URL copied from the Cloud Administration Console.

   • Registration Code: Paste the code copied from the Cloud Administration Console.

5. Click Connect to the RSA Cloud Authentication Service.

   A message appears stating "Connection Successful".

6. On successful registration, do the following.

   • Select the Create Collector checkbox to create an ADC collector.

   • Select the User Sync with IDPlus checkbox to onboard the new user to the IDPlus application.

7. Enter the IDPlus Lookup Api and click Next.
   

8. On Page 2 (Connection), provide the following details:

   1. Enter Base URL.

   2. Select OAuth2 from the User Authentication Type drop-down list.

   3. Enter Client ID, Client Secret, Authentication URL, and Access Token URL.

   4. Click Get OAuth 2.0 Access Token.

   5. Click Next.

9. On Page 3 (Select types of account data to collect), select Accounts and click Next.

10. On Page 4 (Configuration of Account collection), do the following.

    1. Enter the Request Parameters.

    2. Enter the Header Name and Header Value in the given fields.

    3. Enter the Response Path for the Collector Mapping Parameters.

    4. To check the records, click Test Rest API - 1.

    5. Click Next.

11. On Page 6 (Map Collector Attributes to Account Attributes), do the following.

    1. In the User Reference drop-down list, select AccountId.

    2. Click Next.
       A confirmation page appears for the Create IDPlus Application.

12. On Page 7 (Edit User Resolution Rules), do the following.

    1. Click Add More, and then click Next.

    2. Review the details and click Finish.
       IDPlus Application has been created and displayed on the Admin > IDPlus Connect page.

13. Click the IDPlus Application displayed under the Application Name.

14. To collect the accounts, do the following.

    1. Navigate to Collectors and click the ADC collector.

    2. Click Test.
       The collected accounts are displayed on the Accounts page.

Test the Lookup API

To test the Lookup API, perform the following steps.

Procedure 

1. Add a new user.

2. On the home page, navigate to Collectors > Identity Collection.

3. To run the Identity Collection, do the following.

   1. Select the Collector.

   2. Click the Collect Identity button.

      You can monitor the collection on the Monitoring page.

Delete the IDPlus/CAS Application and Collectors

Perform the following steps to remove the IDPlus/CAS application and its associated collectors from G&L.

Before you begin 

Ensure you are logged in to the G&L application with the administrative privileges.

Procedure 

1. Navigate to Admin > IDPlus Connect.

2. Select the IDPlus/CAS application that you want to delete.

3. On the Collectors tab, select IDPlus_ADC collector and click Deactivate.

4. After deactivation, click the Delete icon present at the right corner of the application to remove the collector.

5. Return to the General tab of the IDPlus/CAS application.

6. Click Delete to remove the application.

Configure the Remote Agent with CAS

Perform the following steps to configure the remote agent with CAS.

Procedure 

1. Download the certificate from the CAS server.

2. Login to G&L application and navigate to Admin > User Interface > Files.

3. Select the SSL certificate files.

4. Upload the IDPlus certificate file and click OK.

5. Download the keystore files from the remote agent.

6. Replace the existing client.keystore file with the newly downloaded file in the remote agent .

7. Restart the remote agent.

Troubleshooting

If the IDPlus/CAS application is deleted before the collector is removed, then the collector may remain in the database and needs to be removed manually.

Before you begin 

• Ensure you have access to the correct database schema depending on your deployment type:

  • Cloud Customers: Navigate to Admin > System > SQL Utility within the application UI and ensure the avuser schema is selected.

  • On-Premise Customers: Access the database directly using a tool such as sqlplus or SQLDeveloper and ensure the avuser schema is selected.

Procedure 

Perform the following steps to manually remove the collector.

1. Run the following query and locate the associated ADC collector to identify the record.

   SELECT * FROM t_oauth2_record WHERE CLIENT_ID = <Client_ID_Here> And TOKEN_URL = <Insert_URL_Here>;

2. From the results, identify the specific ID and respective token URL of the orphaned ADC collector to locate the client ID.

3. Run the following deletion command using the client ID and token URL identified in the previous step to delete the record.

   DELETE FROM t_oauth2_record WHERE CLIENT_ID = <Client_ID_Here> And TOKEN_URL = <Insert_URL_Here>;

4. Run the following query to commit the changes.

   DELETE FROM t_oauth2_record WHERE CLIENT_ID = 'glAdminClientId' and token_url='https://voyager-karma-gp8-ngx.auth-dev.securid.com/oauth/token';

   Note:  In the preceding query, replace <Client_ID_Here> and <Insert_URL_Here> with the actual client ID and token URL found in Step 2.