Configure RSA Cloud Authentication Service

1. Sign into RSA Cloud Administration Console.
2. Click Authentication Clients > Relying Parties.                                                                                                              
3. On the My Relying Parties page, click Add a Relying Party.                                                                                                                                                                                                                                         
4. In Relying Party Catalog, click Add for Generic OIDC.                                                                                                                                 
5. On the Basic Information page, enter a name for the Service Provider in the Name field.
6. Click Next Step.
7. On the Authentication page, choose SecurID Access manages all authentication.                                         
8. In the Primary Authentication Method list, select your desired login method as either Password or SecurID.
9. In the Access Policy list, select a policy that was previously configured.                                                                             
10. Click Next Step.
11. Under Connection Profile, provide the following details as required.
12. 1. Authorization server Issuer URL is auto-populated. This URL is used in Salesforce to form the Callback URL, Token endpoint URL, and Authorize endpoint URL.
    2. The Redirect URL is obtained from Salesforce (see the next section).
    3. Provide a Client ID.
    4. Select a Client Authentication Method.
    5. Provide a client secret or generate it.
    6. Provide the scope as OpenID (scopes should be added in advance. See the Notes section).                                               
    7. Click Save and Finish.
    8. Click Publish Changes. 

Notes

Configure Salesforce

1. Sign into Salesforce admin console https://login.salesforce.com. 
2. Click Switch to Lightning Experience if you are using Salesforce Classic.                                                                               
3. Click the gear icon in the upper-right corner and click Service Setup.                                                                            
4. In the left pane, click Identity > Auth Providers and in the right pane, click New.                                                             
5. Perform the following steps:
   1. For the Provider Type, select OpenID Connect.
   2. Enter the Name for the provider. 
   3. Enter the URL suffix, which is used in the client configuration URLs. 
   4. For Consumer Key, use the Client ID from the RSA connector configuration. 
   5. For Consumer Secret, use the Client Secret from the RSA connector configuration. 
   6. For Authorize Endpoint URL, enter the Authorization Server Issuer URL from the RSA connector. Make sure that /auth is appended at the end. 
   7. For Token Endpoint URL, enter the Authorization Server Issuer URL from the RSA connector. Make sure that /token is appended at the end. 
   8. For User Endpoint URL, enter the Authorization Server Issuer URL from the RSA connector. Make sure that /userinfo is appended at the end. 
   9. Click Automatically create a registration handler under Registration Handler.
   10. Search for the administrator in Execute Registration As.
   11. Click Save.                                                                                                                                                                                
6. Click the Registration Handler link and edit the file. This code can be changed according to the requirement.                                                                                                                                                                                                          Code Snippet

   //TODO:This autogenerated class includes the basics for a Registration
   //Handler class. You will need to customize it to ensure it meets your needs and
   //the data provided by the third party.
    
   global class AutocreatedRegHandler1662762939351 implements Auth.RegistrationHandler{
   global User createUser(Id portalId, Auth.UserData data){
   //The user is authorized, so create their Salesforce user
   User u = new User();
   String username = data.identifier;
   List<User> userList = [Select Id, Name, Email, UserName From User Where ( UserName =: username) AND isActive = true ];
   if(userList != null && userList.size() > 0) {
   u = userList.get(0);
   }
   return u;
   }
    
   global void updateUser(Id userId, Id portalId, Auth.UserData data){
   User u = new User(id=userId);
   update(u);
   }
    
   }

7. Copy the Callback URL and use it as the Redirect URL in the connector (in RSA). 
8. Click My Domain under Company Settings.
9. Under Authentication Configuration, click edit and select the auth provider created.                                                             
10. Click Save.