Configuring RSA SecurID integration

Support for RSA SecurID authentication is integrated into the SA Core and is installed when the SA Core is installed. However, there are several configuration steps that you must complete to begin using RSA SecurID/SA authentication. The SA Core must also have the IP address of the SecurID authentication server and be able to communicate with it in a secure manner.

If you have multiple slices installed in an SA core, the following steps must be performed for each Slice Component bundle host.

• Phase 1: The RSA SecurID authentication configuration file
• Phase 2: Enable RSA SecurID authentication in SA
• Phase 3: Creating or modifying SA users to use SecurID authentication

Phase 1: The RSA SecurID authentication configuration file

1. Contact your RSA SecurID administrator and obtain the file:

   sdconf.rec

2. Copy this file to the following location on all servers in the core that host a Web Services Data Access Engine (twist):

   /var/opt/opsware/crypto/twist

3. Set the file permissions on each server to give the twist user ownership of this file and read privileges:

   chmod 400 /var/opt/opsware/crypto/twist/sdconf.rec

   chown twist /var/opt/opsware/crypto/twist/sdconf.rec

4. Ensure that there is no securid or sdstatus.12 file in the /var/opt/opsware/crypto/twist directory. If either of these files exist, remove them.

Phase 2: Enable RSA SecurID authentication in SA

1. By default, RSA SecurID authentication is not enabled. To enable it, on every server in the core that hosts a Web Services Data Access Engine (twist), shut down this component with the following command:

   /etc/init.d/opsware-sas stop twist

2. Locate the file:

   /etc/opt/opsware/twist/loginModule.conf

   Edit the file and add the line marked in bold in the example below:

   TruthLoginModule {

   com.opsware.login.SecurIDLoginModule sufficient debug=false

   next_tokencode_mode=false new_pin_mode=false;

   com.opsware.login.TruthLoginModule sufficient debug=false;

   };

3. Restart the Web Services Data Access Engine on all servers with the following command:

   /etc/init.d/opsware-sas start twist

4. If you have multiple Slice Component bundles installed, stop the Command Center (OCC) server and HTTPs proxy on all other Slice Component bundle hosts.
5. At this point only the Command Center for the Slice Component bundle host that is being configured as the RSA server is running. Log into that host’s OCC. This will generate the node secret (securid file) and the sdstatus.12 file in the /var/opt/opsware/crypto/twist subdirectory as well as register the Slice Component bundle server with ACE.
6. You can now start the OCC and HTTPs proxies on all the other Slice Component bundle hosts in the Core.

Phase 3: Creating or modifying SA users to use SecurID authentication

Each user that is to use SecurID Authentication must first exist as an authenticated user in the RSA SecurID authentication server (ACE server) and then must either be created or modified in the SA Client to use SecurID authentication.

In the SA Client, on the user’s Profile page, specify that the user’s Credential Store should be RSA 2-factor.

For detailed information about creating or modifying users, see Managing users.