SecurID Authentication

SecurID authentication enables users with RSA SecurID tokens to log in to SGD. SGD authenticates users against an RSA Authentication Manager, formerly known as ACE/Server.

RSA SecurID is a product from RSA Security, Inc., that uses two-factor authentication based on something you know, a PIN, and something you have, a tokencode supplied by a separate token such as a PIN pad, standard card, or software token. The PIN and tokencode are combined to form a passcode which is used as the password when you log in to SGD.

This authentication mechanism is disabled by default.

This section includes the following topics:

• How SecurID Authentication Works

• Setting Up SecurID Authentication

• Configuring SGD Servers as Agent Hosts

• How to Enable SecurID Authentication

How SecurID Authentication Works

At the SGD login screen, the user types their SecurID user name, for example indigo, and their passcode.

This authentication mechanism searches the local repository for a user profile with a Name attribute that matches the user name typed by the user. If there is no match, the search is repeated on the Login Name attribute, and finally on the Email Address attribute.

If a user profile is found, the Login Name attribute of that object is used as the SecurID user name. If no user profile is found, the name the user typed is used as the SecurID user name.

Next, SGD checks the SecurID user name, and the passcode typed by the user, against the RSA Authentication Manager. If the authentication fails, the user cannot log in because there are no further authentication mechanisms to try.

If the authentication succeeds and the Login attribute for the user profile is not enabled, the user is not logged in. If the authentication succeeds and the Login attribute for the user profile is enabled, the user is logged in.

User Identity and User Profile

If a user profile was found in the local repository, this is used for the user identity and user profile. In the SGD datastore, the user identity is in the Local namespace. In the Administration Console, the text “(Local)” is displayed next to the user identity. On the command line, the user identity is located in .../_ens.

If no user profile was found in the local repository, the user identity is the SecurID user name. In the SGD datastore, the user identity is in the SecurID namespace. In the Administration Console, the text “(SecurID)” is displayed next to the user identity. On the command line, the user identity is located in .../_service/sco/tta/securid.

The profile object System Objects/SecurID User Profile is used for the user profile.

Setting Up SecurID Authentication

Setting up SecurID authentication involves the following configuration steps:

1. Install and configure RSA SecurID.

   Ensure you are using a supported version of RSA SecurID. The supported versions of SecurID are listed in the Oracle Secure Global Desktop 4.6 Platform Support and Release Notes available at http://docs.sun.com/app/docs/doc/821-1928.

   Ensure the RSA Authentication Manager is up to date with the latest patches released by RSA.

2. Configure each SGD server in the array as an Agent Host.

   Each SGD server in the array acts an Agent Host so that it can authenticate users against the RSA Authentication Manager.

   See Configuring SGD Servers as Agent Hosts.

3. Enable SecurID authentication in SGD.

   Configure SecurID authentication so that SecurID users can log in to SGD.

   See How to Enable SecurID Authentication.

Configuring SGD Servers as Agent Hosts

To use SecurID authentication, each SGD server in the array must be configured as an Agent Host. As SecurID implementations can vary, the following procedure is an example only. Consult your SecurID documentation for details of how to configure an Agent Host.

How to Configure an SGD Server as an Agent Host

Before You Begin

Before you begin, ensure you have access to the RSA Authentication Manager configuration file, sdconf.rec.

1. Log in as superuser (root) on the SGD host.

2. Ensure the SGD server can contact the RSA Authentication Manager on the network.

   You might have to open ports in your firewalls to enable an SGD server to contact the RSA Authentication Manager.

   The default ports that must be open are the following:

   • UDP port 5500 from the SGD server to the Authentication Manager.

   • UDP ports 1024 to 65535 from the Authentication Manager to the SGD server.

3. Specify the location of the RSA Authentication Manager configuration file.

   1. Create the /etc/sdace.txt file with the following content:

      VAR_ACE=/opt/ace/data

   2. Save the file.

4. Copy the RSA Authentication Manager configuration file to the SGD server.

   1. Create an /opt/ace/data directory.

   2. Copy the sdconf.rec file to the /opt/ace/data directory.

5. Set the file permissions so that SGD can read and write the configuration files.

   # chmod 444 /etc/sdace.txt
   # chown -R ttasys:ttaserv /opt/ace
   # chmod -R 775 /opt/ace

6. Register the SGD servers as Agent Hosts in the RSA Authentication Manager database.

   Use either the RSA Authentication Manager Database Administration application or sdadmin application.

   Add the SGD server as a UNIX Agent Host in the database, using the fully qualified name, server.domain.com.

   For each Agent Host, Configure Group or User Activation. Alternatively, set the Open to All Locally Known Users option.

How to Enable SecurID Authentication

1. In the SGD Administration Console, display the Secure Global Desktop Authentication Configuration Wizard.

   Go to the Global Settings -> Secure Global Desktop Authentication tab and click the Change Secure Global Desktop Authentication button.

2. On the Third-Party/System Authentication step, ensure the System Authentication check box is selected.

3. On the System Authentication - Repositories step, select the SecurID check box.

4. On the Review Selections step, check your authentication configuration and click Finish.