SecurID Authenticate Tokencode Integration Issues and Solutions

See Enable the RSA SecurID Authenticate App for Specific Users to enable these users to use the Authenticate Tokencode.

Version 8.4 users without active tokens do not require this procedure.

The node secret encrypts communication between an authentication agent and AM. Node secrets are required for users to authenticate on RSA authentication agents.

If you install a new authentication agent, make sure that there is a node secret. AM automatically creates and sends the node secret to the authentication agent after a user successfully authenticates to the agent with an RSA SecurID hardware token, an RSA SecurID software token, or a fixed passcode, or after an administrator manually creates the node secret with the Node Secret Load Utility. Using the RSA Authenticator app for Authenticate Tokencode or PIN with Approve authentication does not create the node secret.

You might need to refresh the node secret when an administrator has cleared the node secret on both an authentication agent and the AM instance. For instructions, see Refresh the Node Secret .

You can assign up to three active tokens per user, unless an administrator reduces this number, as described in Restrict the Number of Active Tokens per User. The RSA SecurID Authenticate app counts against this limit.

Disable or unassign at least one active RSA SecurID hardware or software token.

In this configuration, any changes in the Cloud Authentication Service deployment require updates in AM. For example, you can provide AM with the updated hostname or IP address used by the SecurID identity router. For instructions, see Repair an RSA Trusted Realm.

If the trusted realm uses more than one IP address, edit the hosts file, as described in Add an SecurID Deployment to RSA Authentication Manager as a Trusted Realm.

The time difference between the RSA Authentication Manager instance and the identity router is greater than 50 seconds. Make sure the RSA Authentication Manager instances and identity routers synchronize the time against the same Network Time Protocol (NTP) server.

On each RSA Authentication Manager primary or replica instance, log on to the Operations Console and select Administration > Date & Time.

To change the time on the RSA identity router, contact your Cloud Authentication Service administrator.

For each authentication agent being used with the RSA trusted realm, selectEnable Trusted Realm Authentication.

For instructions, see Add an Authentication Agent.

Contact your RSA administrator.

The Cloud Authentication Service administrator might need to synchronize the identity source with the Cloud Authentication Service. For instructions, see the RSAIDR SSO AgentSetup and Configuration Guide.

Ask the user to authenticate again. If authentication continues to fail, then contact your Cloud Authentication Service administrator.

The Cloud Authentication Service administrator might need to see the Help topic Troubleshooting Cloud Access Service User Issues for possible solutions.