RSA SecurID - need some help

[cryptochrome_]

Hi, 

a couple of years ago I already set this up once and it worked back then. Now I want to so the same thing again but I am not getting anywhere.

IVE 7.3

AD Server

ACE Server

I want to set up my realm so that the first auth server is AD and the second is RSA. However, if I choose AD as the first auth server, the RSA server is not showing up as an option for the second auth server. If I specify the RSA server as being the first, then the AD server does not show up as an option for the second. 

If I only select RSA (and no secondary), then I no longer have the option to create role mapping rules based on user groups (the option is simply missing).

Can someone shed some light on this for me, please?

Thanks

[zanyterp_]

thank you for sharing

[Era_]

Hi!

Here are some details regards our RSA case - http://kb.pulsesecure.net/KB23202

In general just configure AD as LDAP server and as result it will be available under RSA -Directory/Attribute drop list.

It works for my configuration for 20 RSA roles based on AD groups memberships.

Hope it helps.

[braker_]

For clarification, when you set the RSA server as the authentication server, the AD server is not listed in the directory/attribute server drop-down?

Have you tried setting up an LDAP server instance that points to your AD environment as the directory/attribute server?

[cryptochrome_]

Yes, braker, exactly right. When selecting RSA as authentication server, I can not select the AD server as directory/attribute server.

As for you other question: We have an additional LDAP server (pointing to a Novell eDirectory). I can select that as a directory/attribute server, but that's not what I need/want. I need the combination of RSA and Active Directory.

Thanks!

[NateK_]

We use Mi-Token in place of RSA and our setup looks like the attached.

This is under Users > User Realms > RealmName > General tab

Both of the authentication servers ('Active Directory' and 'MiToken') are setup under Authentication > Auth Servers

In our setup you authenticate via AD credentials first and then Mi-Token code.

RSA setup should be the same/similar.

[filbert_]

You can't use Native AD as an authorization server. It can only be an authenticaion server. If you confgured AD using LDAP then you could use that as an authorization server.

[cryptochrome_]

---

@Filbert wrote:

You can't use Native AD as an authorization server. It can only be an authenticaion server. If you confgured AD using LDAP then you could use that as an authorization server.

---

Ok. And that would give me the option to authenticate users agains AD and then ask them for their SecurID Tokencode?

Why would native AD not work?

Thanks

Sascha

[NateK_]

I just took a gander at my AD auth server setup and it looks like a combo of AD action with LDAP for group searching.

Back to the OP, you should be able to get your IVE setup so that AD authentication happens first and then secondary authentication to the RSA device.

Basically - AD credentials entered by user, verified by AD servers, then RSA token code, verified by SecurID server.

Both AD and RSA will need to be setup as Auth servers on your IVE and you should be golden.

[cryptochrome_]

---

NateK wrote:

Both AD and RSA will need to be setup as Auth servers on your IVE and you should be golden.

---

Well it doesn't, at least not when AD is setup as "native", not LDAP. Can you confirm that your AD configuration is based on LDAP rather than native AD connection?

Thanks