Cloud Authentication Enablement Issues and Solutions

If you receive an error that is related to enabling Cloud authentication on the Security Console Home page, see the following table.

Issue	Solution
An error message states that the node secret is not available on the authentication agent. or The node secret does not exist on the authentication agent, but there is no error message.	The node secret encrypts communication between an authentication agent and AM. Node secrets are required for users to authenticate on RSA authentication agents. If you install a new authentication agent, make sure that there is a node secret. AM automatically creates and sends the node secret to the authentication agent after a user successfully authenticates to the agent with an RSA SecurID hardware token, an RSA SecurID software token, or a fixed passcode, or after an administrator manually creates the node secret with the Node Secret Load Utility. Using the RSA Authenticator app for Authenticate Tokencode, Approve, or Device Biometrics authentication does not create the node secret. You might need to refresh the node secret when an administrator has cleared the node secret on both an authentication agent and the AM instance. For instructions, see Refresh the Node Secret .
A user already has the maximum number of tokens.	You can assign up to three active tokens per user, unless an administrator reduces this number, as described in Restrict the Number of Active Tokens per User. The RSA Authenticator app counts against this limit. Disable or unassign at least one active RSA SecurID hardware or software token.

Issue

Solution

An error message states that the node secret is not available on the authentication agent.

The node secret does not exist on the authentication agent, but there is no error message.

The node secret encrypts communication between an authentication agent and AM. Node secrets are required for users to authenticate on RSA authentication agents.

If you install a new authentication agent, make sure that there is a node secret. AM automatically creates and sends the node secret to the authentication agent after a user successfully authenticates to the agent with an RSA SecurID hardware token, an RSA SecurID software token, or a fixed passcode, or after an administrator manually creates the node secret with the Node Secret Load Utility. Using the RSA Authenticator app for Authenticate Tokencode, Approve, or Device Biometrics authentication does not create the node secret.

You might need to refresh the node secret when an administrator has cleared the node secret on both an authentication agent and the AM instance. For instructions, see Refresh the Node Secret .

A user already has the maximum number of tokens.

You can assign up to three active tokens per user, unless an administrator reduces this number, as described in Restrict the Number of Active Tokens per User. The RSA Authenticator app counts against this limit.

Disable or unassign at least one active RSA SecurID hardware or software token.

Send an RSA SecurID Authenticate Invitation to Users

Don't see what you're looking for?

Salesforce MFA Enforcement – Action Required

Cloud Authentication Enablement Issues and Solutions

Related Articles

Trending Articles