Requesting RSA to create additional Super Administrator accounts for the RSA SecurID Access Cloud Authentication Service
2 years ago
Originally Published: 2017-09-13
Article Number
000048461
Applies To
RSA Product Set: ID Plus
RSA Product/Service Type: Cloud Authentication Service
RSA Version/Condition: All
Issue
RSA creates only one Super Administrator account for logging into the Cloud Administration Console and provides the associated username and password in an email message when new Cloud Authentication Service deployments are provisioned. Use this account to add new administrators.
RSA strongly recommends that you add Super Administrator accounts for multiple staff members to ensure that one can always perform tasks if other administrators are unavailable or their accounts are disabled or deleted. Also, if one Super Admin account needs help with a password reset, another Super Admin can access the account and change the password. 
Tasks
Any user with a Super Administrator account can login to the Cloud Administration Console and create additional Super Administrator accounts. Refer to the online help which explains how in section "Add an Administrator " on page Add, Edit, or Delete an Administrator in the Cloud Administration Console .

If the person who receives the initial credentials email from RSA does not intend to be a Super Administrator for the RSA Cloud Authentication Service, the credentials email should be securely passed to another person who will be doing that work:

  • Securely give RSA's Initial Administrator Account email to the person who will be taking that role.  The steps below should also be given to that person to follow when they receive the email:
    1. Login with the Initial Administrator Account credentials from the email.  This means you will temporarily be logging in using another person's email address as your User ID. If you are prompted to change the password of the account, that must be done.
    2. Follow the steps in section "Add an Administrator " on page Add, Edit, or Delete an Administrator in the Cloud Administration Console to create a new Super Administrator account with your own email address in the Username field.
    3. Logout of the Initial Administrator Account.
    4. Login with your new Super Administrator Account credentials created in step 2, above.
    5. Follow the steps in section "Delete an Administrator" on page Add, Edit, or Delete an Administrator in the Cloud Administration Console to delete the Initial Administrator Account that was in the forwarded email.
  • Note that RSA normally strongly recommends against sharing administrator credentials between people.  However, there is no harm in doing so only in the unique circumstance explained above, because no configuration information would have yet been entered into the RSA Cloud Administration Console.  When that happens, the above steps are necessary to ensure the email address is correct for the new super administrator.  That will allow easy reset of a forgotten password  (if needed in the future) and for administration audit reasons.
Resolution
  • When the first Super Administrator logs into the RSA Cloud Administration Console, they will be able to login to create additional Super Administrator accounts.
  • It is your organization's responsibility to manage all administrators and ensure there are sufficient administrators available at all times to administrate the Service as your organization requires.  Apart from the provision of one set of initial Super Administrator credentials, RSA does not participate in the management of your RSA Cloud Authentication Service administrators.