Secure Global Desktop 4.40 Administration Guide > Users and Authentication > SecurID Authentication
SecurID authentication allows users with RSA SecurID tokens to log in to SGD. SGD authenticates users against an RSA Authentication Manager (formerly known as ACE/Server).
RSA SecurID is a product from RSA Security, Inc., that uses two-factor authentication based on something you know (a PIN) and something you have (a tokencode supplied by a separate token such as a PIN pad, standard card or software token). The PIN and tokencode are combined to form a passcode which is used as the password when you log in to SGD.
This authentication mechanism is disabled by default.
This page includes the following topics:
At the SGD login screen, the user types their SecurID user name
indigo) and their passcode.
This authentication mechanism searches the local repository for a user profile with a Name attribute that matches the user name typed by the user. If there is no match, the search is repeated on the Login Name attribute, and finally on the Email Address attribute.
If a user profile is found, the Login Name attribute of that object is used as the SecurID user name. If no user profile is found, the name the user typed is used as the SecurID user name.
Next, SGD checks the SecurID user name, and the passcode typed by the user, against the Authentication Manager. If the authentication fails, the user cannot log in because there are no further authentication mechanisms to try.
If the authentication succeeds and the Login attribute for the user profile is not enabled, the user is not logged in. If the authentication succeeds and the Login attribute for the user profile is enabled, the user is logged in.
If a user profile was found in the local repository, this is used for the user identity and user profile.
In the SGD Administration Console, the user identity is displayed as
On the command line, the user identity is displayed as
If no user profile was found in the local repository, the user identity is the SecurID user name. In the SGD Administration Console, the user identity is displayed as
SecurID-username (SecurID). On the command line, the identity is displayed as
.../_service/sco/tta/securid/SecurID-username. The profile object
System Objects/SecurID User Profile is used for the user profile.
Application sessions and password cache entries belong to either the user profile or SecurID User Profile object, depending on which is used.
The Secure Global Desktop Release Notes has details of the supported versions of the RSA Authentication Manager.
Update Authentication Manager with the latest patches released by RSA.
Configure each SGD server in the array as an Agent Host so that it can authenticate users against the Authentication Manager.
Configure SecurID authentication so that SecurID users can log in to SGD.
To use SecurID authentication, each SGD server in the array must be configured as an Agent Host. As SecurID implementations can vary, the following procedure is an example only.
Before you begin, ensure you have access to the RSA Authentication Manager configuration file
You might have to open ports in your firewalls to allow an SGD server to contact the Authentication Manager.
The default ports that must be open are the following:
/etc/sdace.txtfile with the following content:
sdconf.rec) file to the
# chmod 444 /etc/sdace.txt # chown -R ttasys:ttaserv /opt/ace # chmod -R 775 /opt/ace
Use either the Authentication Manager Database Administration application or
Add the SGD server as a UNIX Agent Host in the database, using the fully qualified name
For each Agent Host, Configure Group or User Activation. Alternatively, set the Open to All Locally Known Users option.
Note SGD supports either system-generated PINs or user-created PINs.
On the Global Settings » Secure Global Desktop Authentication tab, click the Change Secure Global Desktop Authentication button.
Copyright © 1997-2007 Sun Microsystems, Inc. All rights reserved.