RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.2 and newer

The RSA AUthenticaiton Manager 8.9 Bulk Administraton Utility (AMBA) Guide is an excellent resource but can be daunting for new users.  This page serves as a Quick Start guide on setting up and configuring AMBA.

AMBA has been bundled with Authentication Manager starting with version 8.2.  However, it requires an Enterprise license in order to run.  Please review steps to request an license for AMBA for details.

AMBA is a built-in utility available to RSA Authentication Manager customers with an Enterprise license.  It is a command-line utility that lets you create, modify and/or delete a wide variety of Authentication Manager objects, with functions such as:

• Create Users (internal database only)
• Create User Groups (internal database only)
• Create User Alias records
• Assign Tokens
• Distribute Software Tokens
• Create Authentication Agents
• Clear Agent Node Secrets
• Unassign Tokens
• Extend Token Lifetime
• Assign Administrative Roles
• and more.

There are nearly one hundred different functions available through AMBA. Review the RSA Authentication Manager 8.9 Bulk Administration Utility (AMBA) Guide for a complete list.

How does AMBA work?
AMBA contains a long list of function codes, denoted by 2- to 5-letter abbreviations. You invoke AMBA using the rsautil command-line utility. AMBA needs the following in order to operate:

• An administrative account in the Internal Database that has been assigned the SuperAdmin role;
• An .ini file that contains the credentials for this administrator;
• An input file in .CSV format containing the AMBA commands and the values and variables required. Note that each command is different.  Some require several variables to be specified, some have optional input fields, and some have no operators at all.

When AMBA is run, an optional log file is created that calls out any errors encountered during the run.  This log will indicate which lines were problematic, and will offer some indication as to why the failure occurred (i.e. user already exists, token serial number not found, etc.).

HOW TO PREPARE AN AMBA SCRIPT

AMBA requires a .CSV file (Comma Separated Values) to run.  AMBA is absolute when it comes to commas; they are always field separators, and cannot be contained within your data.  You cannot bracket a comma in quotes and expect the system to recognize the comma as data.  It is always a field separator.  There are no exceptions.

The easiest way to create a CSV file is using a spreadsheet such as Excel. The first row will contain the field definitions, and the rows below it will contain the data. For example, here is a script that will create a list of users in the Internal Database:

Any line starting with two forward slashes (//) is a comment and will be ignored. The next line contains the command headers. In the example above, the Action is AU (Add User). The first data field is the UserID, which AMBA calls DefLogin.  LastName and SecurityDomain are self-explanatory.  This example will create a user called AppID001, with the same value for LastName, and put it in the tsa-apps security domain. Unless specified otherwise, AMBA always looks in the Internal Database and the default SystemDomain.
You can use all sorts of tricks in Excel, such as copying the value from B3 into C3 so that you don’t have to type the values twice. Note that, once you save the data in .CSV format, any cell references are lost, and only the data remains.
For this example, we will save this file in .CSV format and call it amba-create_userid.csv (Note: it’s a good idea not to put spaces in these file names, since AMBA is a command-line utility).

HOW TO SET UP AMBA

1. You will need an internal database user with the SuperAdmin role assigned.  If you do not already have one, in the Security Console, go to Users > Add New.  Enter the user Last Name, User ID, and password, then click Save:

2. On the next screen, click the drop-down arrow next to the UserID you just created and choose Administrative Roles:

3. Click Assign Role, find the SuperAdminRole, and click Assign Role.
4. Ensure that SSH is enabled to the Primary, by going to the Operations Console > Administration > Operating System Access, and ensuring that there is a check mark next to Interface eth0:

5. Open an SSH connection to the Primary using PuTTY, SecureCRT, or similar.  Log in as rsaadmin using the Linux operating system password.  Create a directory called /opt/rsa/am/amba by typing the following command:
        mkdir /opt/rsa/am/amba

6. Copy your .csv file to this directory, using WinSCP, SecureFX, or any other secure file transfer utility.  If you view it in the vi editor, it should look something like the example below.  Check for any errors or stray commas, then save using [Esc]:wq

7. The last step before running AMBA is to create an .ini file containing the credentials for your SuperAdmin user. The .ini file is encrypted the first time AMBA is run, so there is no danger of these user credentials being discovered. A sample ini file looks like this:

-i /opt/rsa/am/amba/amba-create_userid.csv
--newlog
-m 2
-o /opt/rsa/am/amba/AMBA-run.log
-p 30
-a ambaadmin
-P MySecretPa55w0rd!

Where,

• • The first line uses the -i flag to specify the input file, and points to your CSV file. 
  • The next line will create a new log every time AMBA is run.
  • -m 2 sets the logging level to 2 (medium),
  • -o provides the path and filename of the log file.
  • -p 30 (lowercase p) indicates to give a progress report every 30 seconds, which is useful if you’re trying to process a file that has several thousand entries.
  • -a is the SuperAdmin account, and
  • -P (uppercase) is the password for that account.

Only use a pure text utility such as vi, Notepad++, or Notepad to create this file. The ticks above are single-tick characters, and most word processors are notorious for replacing two ticks (--) with long dashes instead (–).
Check for errors, then save to the /opt/rsa/am/amba directory.  In this case we will call it example.ini.  Note that AMBA will encrypt this file the first time you invoke it, so your credentials will not be exposed.

HOW TO RUN AMBA

1. AMBA is already pre-installed in RSA Authentication Manager 8.2 and later. All you have to do to run it is to invoke it at the command line and point it to your .ini file. The .ini file then provides the user credentials and the input file to be processed.
   From the command line of the Primary, change to your amba directory:
         cd /opt/rsa/am/amba
2. Invoke AMBA using the rsautil command with the name of the .ini file you created.
         ../utils/rsautil AMBulkAdmin --ini /opt/rsa/am/amba/example.ini

Note that this is Linux and spelling is critical. There are four capital letters in AMBulkAdmin, and they spell AMBA.

3. As the job runs, you will get console output showing the start of the job, how many lines have run (every 30 seconds), then an end of job message:

4. Verify that things went well by checking the log file:

In this case the job failed, specifically because we were trying to add users that already existed.

For additional information, refer to the AMBA Guide that matches your version of Authentication Manager:

• Authentication Manager 8.9 Bulk Administration Utility
• Authentication Manager 8.8 Bulk Administration Utility
• Authentication Manager 8.7 SP2 Bulk Administration Utility
• Authentication Manager 8.7 SP1 Bulk Administration Utility
• Authentication Manager 8.7 Bulk Administration Utility
• Authentication Manager 8.6 Bulk Administration Utility (EOPS August 2026)