RSA Product Set:  ID Plus and SecurID

RSA Product/Service Type: Cloud Access Service, Identity Router, and Authentication Manager

After configuring the Identity Router as a SecurID Agent in the Administration Console Platform > Authentication Manager > Test Connection is unsuccessful.  After collecting the identity router log bundle errors similar to below are seen in /var/log/symplified/symplified.log:

2017-12-12/17:10:08.538/UTC [sidProxyScheduler-1] FATAL com.rsa.authagent.authapi.v8.logger.b[?] - {validateSignCertwithRootCert} ConfigResponse Signing Cert Validation failed Certificate verify failed!
2017-12-12/17:10:08.539/UTC [sidProxyScheduler-1] FATAL com.rsa.authagent.authapi.v8.logger.b[?] - {validateConfigResponse} ConfigResponse signing cert validation and verification failed: com.rsa.authagent.authapi.AuthAgentException: Signature Certificate Verification Failed:Certificate verify failed!
2017-12-12/17:10:08.539/UTC [sidProxyScheduler-1] FATAL com.rsa.authagent.authapi.v8.logger.b[?] - {handleConfigUpdate} ConfigurationResponse(Init) - Response validation & verification failed
2017-12-12/17:10:08.539/UTC [sidProxyScheduler-1] ERROR com.rsa.authagent.authapi.v8.logger.b[?] - Exception processing configuration data Exception processing configuration data Invalid config response from the server: Response validation & verification failed!
2017-12-12/17:10:08.539/UTC [sidProxyScheduler-1] ERROR com.rsa.nga.sidproxy.SidAuthentication[263] - Failed to verify session factory
com.rsa.authagent.authapi.AuthAgentException: com.rsa.authagent.authapi.AuthAgentException: Exception processing configuration data Exception processing configuration data Invalid config response from the server: Response validation & verification failed!
at com.rsa.authagent.authapi.AuthSessionFactory.a(AuthSessionFactory.java)

Update the Authentication Manager agent communications root certificate and then publish a new sdconf.rec file to the Identity Router.
 

Note that instructions to retrieve the root certificate vary by browser type, the instructions below are for Chrome.

1. Browse to https://<YOUR_AUTH_MANAGER>:7002 and ignore the 404 error.
2. Click on the three vertical dots in upper right and choose More tools > Developer tools.
3. In the Tools window click the Security tab and then, from Security Overview click View certificate.
4. In the Certificate popup, click the Certification Path tab and the top level root certificate
5. Click the View Certificate button.
6. Click the Details tab then the Copy to File button.
7. Follow the wizard to save a .DER encoded certificate to a file.
8. Now in the RSA Authentication Manager Security Console go to Setup > System Settings > Agents.
9. Click on the link labeled To configure agents using IPV6, click here.
10. In the Existing Certificate Details section click Choose File and select the just exported Authentication Manager root certificate file and then click Update.
11. Now browse to Access > Authentication Agents > Generate Configuration File. 
12. Generate and download a new AM_Config.zip file.
13. Unzip the AM_Config.zip to extract the new sdconf.rec.
14. Upload the new sdconf.rec file via the ID Plus Cloud Administration Console > Platform > Authentication Manager > Connection Settings menu and click Save.
15. Click Publish Changes.

The Test Connection should be successful following the Publish.