Lieberman Software. RSA SecurID Ready Implementation Guide. Account Reset Console. Partner Information. Last Modified: March 20 th, 2012

Transcription

1 RSA SecurID Ready Implementation Guide Last Modified: March 20 th, 2012 Partner Information Product Information Partner Name Web Site Product Name Lieberman Software Corporation Version & Platform 6.0 Product Description is a central point of management for user logon account password resets and password reset auditing for the Microsoft Windows platform.

2 Solution Summary is a privileged password management platform. It provides the Help Desk with the ability to reset domain account passwords/account flags, and allows users to reset their own forgotten or expiring passwords in a fully audited and delegated manner via any web browser. RSA SecurID authentication controlled access is provided to the web users of the application. Full token management including Next Token and New PIN selection are provided. Both RSA Authentication Manger and track RSA SecurID logons for audit purposes. RSA SecurID supported features 6.0 RSA SecurID Authentication via Native RSA SecurID Protocol Yes RSA SecurID Authentication via RADIUS Protocol No On-Demand Authentication via Native SecurID Protocol On-Demand Authentication via RADIUS Protocol RSA Authentication Manager Replica Support Secondary RADIUS Server Support RSA SecurID Software Token Automation RSA SecurID SD800 Token Automation RSA SecurID Protection of Administrative Interface Yes No Yes No No No Yes - 2 -

3 - 3 -

4 Authentication Agent Configuration Authentication Agents are records in the RSA Authentication Manager database that contain information about the systems for which RSA SecurID authentication is provided. All RSA SecurIDenabled systems require corresponding Authentication Agents. Authentication Agents are managed using the RSA Security Console. The following information is required to create an Authentication Agent: Hostname IP Addresses for network interfaces Set the Agent Type to Standard Agent when adding the Authentication Agent. This setting is used by the RSA Authentication Manager to determine how communication with Lieberman Account Reset Console will occur. A RADIUS client that corresponds to the Authentication Agent must be created in the RSA Authentication Manager in order for Lieberman to communicate with RSA Authentication Manager. RADIUS clients are managed using the RSA Security Console. Note: Hostnames within the RSA Authentication Manager / RSA SecurID Appliance must resolve to valid IP addresses on the local network. RSA SecurID files RSA SecurID Authentication Files Files sdconf.rec Node Secret sdstatus.12 sdopts.rec Location %windir%\sdconf.rec %windir%\sdconf.rec %windir%\sdconf.rec Not implemented Note: The appendix of this document contains more detailed information regarding these files

5 Partner Product Configuration Before You Begin This section provides instructions for configuring the Lieberman with RSA SecurID Authentication. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to install the required components. All Lieberman components must be installed and working prior to the integration. Perform the necessary tests to confirm that this is true before proceeding. Configuring Installing the RSA Authentication Agent The first step in configuring the product is to install the RSA SecurID Authentication Agent on the server. Confirm that the RSA SecurID Authentication Agent is capable of authentication by using the RSA Security Center located in the Window s control panel to perform a successful authentication test. Important: Do not attempt to set up RSA SecurID authentication within the application until you can successfully authenticate with the agent. If the agent does not successfully authenticate, RSA SecurID authentication within the product will NOT be successful

6 Add user group(s) that require(s) RSA SecurID Authentication 1. Log into and navigate to Management Program Access. 2. Check Require Web Logon with RSA and enter the group name. Click the Add button

7 3. The new rule will now appear under the Global Program Access Rules list. All users that belong to the group will require RSA SecurID Authentication when logging into the. Note: If a user belongs to both Allow Web Logon and Require Web Logon with RSA groups, they will be required to perform an RSA SecurID Authentication

8 Using On-Demand Tokencodes Select the On-Demand Tokencode checkbox when using this feature. This will change the end user prompt which makes the authentication flow of on-demand easier to follow

9 Screens Login screen: User-defined New PIN: - 9 -

10 System-generated New PIN: Next Tokencode:

11 Certification Checklist for RSA Authentication Manager Date Tested: March 20 th, 2012 Certification Environment Product Name Version Information Operating System RSA Authentication Manager 7.1 SP4 Microsoft Windows Server 2003 R2 RSA Authentication Agent Microsoft Windows Server 2003 (x86) Access Reset Console Microsoft Windows Server 2003 (x86) Mandatory Functionality RSA Native Protocol RADIUS Protocol New PIN Mode Force Authentication After New PIN Force Authentication After New PIN N/A System Generated PIN System Generated PIN N/A User Defined (4-8 Alphanumeric) User Defined (4-8 Alphanumeric) N/A User Defined (5-7 Numeric) User Defined (5-7 Numeric) N/A Deny 4 and 8 Digit PIN Deny 4 and 8 Digit PIN N/A Deny Alphanumeric PIN Deny Alphanumeric PIN N/A Deny Numeric PIN Deny Numeric PIN N/A Deny PIN Reuse Deny PIN Reuse N/A Passcode 16-Digit Passcode 16-Digit Passcode N/A 4-Digit Fixed Passcode 4-Digit Fixed Passcode N/A Next Tokencode Mode

12 Next Tokencode Mode Next Tokencode Mode N/A On-Demand Authentication On-Demand Authentication On-Demand Authentication N/A On-Demand New PIN On-Demand New PIN N/A Load Balancing / Reliability Testing Failover (3-10 Replicas) Failover N/A No RSA Authentication Manager No RSA Authentication Manager N/A JJO = Pass = Fail N/A = Not Applicable to Integration

13 Appendix Partner Integration Details RSA SecurID API RSA Authentication Agent Type RSA SecurID User Specification Display RSA Server Info Perform Test Authentication Agent Tracing SecurID Agent Standard Agent Designated Users (via group) Yes, via RSA Agent Yes, via RSA Agent Yes Node Secret: The node secret is maintained by the RSA SecurID Authentication Agent outside of the Account Reset Console application. sdconf.rec: The node secret is maintained by the RSA SecurID Authentication Agent outside of the Account Reset Console application. sdopts.rec: Not used. sdstatus.12: The node secret is maintained by the RSA SecurID Authentication Agent outside of the Account Reset Console application

14 Agent Tracing: Using Regedit, locate the HKEY_LOCAL_MACHINE\Software\SDTI\ACECLIENT key and create 2 DWORD values: tracelevel and tracedest. The value tracelevel specifies the verbosity and the categories of messages produced by the code. The value tracedest controls the output destination of the trace messages. tracedest VALUES: SDITRACE_EVENT_LOG 0x // messages to event log SDITRACE_CONSOLE 0x // messages to console SDITRACE_LOGFILE 0x // messages to logfile (aceclient.log) SDITRACE_DEBUGGER 0x // messages to debugger output SDITRACE_NOFILELINE 0x // no file and line information The SDITRACE_NOFILELINE value can be combined with any of the other values to stop the display of file and line number information. The logfile is %SystemRoot%\ACECLIENT.LOG but can be changed by creating a REG_SZ:tracefile value and specifying the file pathname. tracelevel VALUES: SDITRACEING_OFF 0x // All messages off SDITRACEING_ON 0x // All messages marked with this level on SDITRACEING_ENTRY 0x // All entrypoints use this SDITRACEING_EXIT 0x // All function returns use this SDITRACEING_FLOW 0x // All logic flow control use this (ifs) SDITRACEING_GRP1 0x // Old SDITRACE macros use this (see dbglib.h) The hex value 0xF gives the complete set of tracing. The values can be combined to produce multiple sets of trace messages. Note: Using the SDITRACE_CONSOLE value can cause the service applications to access violate during logoff. Use only for real time debugging situations