RSA Identity Governance and Lifecycle Generic SOAP Web Service Connector Application Guide. Generic SOAP Web Service Connector Application Guide

Transcription

1 Generic SOAP Web Service Connector Application Guide Version 1.3 Nov

2 Contents Revision History... 4 Preface... 5 Audience... 5 In This Guide... 5 Configuring SSL client certificate based authentication... 6 Adding certificates in the keystore for WebLogic Application Server... 6 Adding certificates in a default java trust-store for SSL configuration for connectors (cacerts)... 7 Setting Hostname verification property... 8 Steps for setting hostname verification property in ACM - WildFly Server:... 8 Steps for setting hostname verification property in ACM WebLogic Server:... 8 Steps for setting hostname verification property in ACM - WebSphere Server:... 8 Steps for setting hostname verification property in AFX:... 9 Using RSA Identity Governance and Lifecycle SOAP Web Service Connector... 9 Configuration... 9 Capabilities Settings Example Setting up SOAP Connector Tips & Troubleshooting COPYRIGHTS TRADEMARKS

3 Contact Information RSA Link at contains a knowledge base that answers common questions and provides solutions to known problems, product documentation, community discussions, and case management. Trademarks RSA, the RSA Logo, and EMC are either registered trademarks or trademarks of Dell Inc. throughout the world. All other trademarks used herein are the property of their respective owners. For the most up-todate listing of RSA trademarks, go to License Agreement This software and the associated documentation are proprietary and confidential to EMC, are furnished under license, and may be used and copied only in accordance with the terms of such license and with the inclusion of the copyright notice below. This software and the documentation, and any copies thereof may not be provided or otherwise made available to any other person. No title to or ownership of the software or documentation or any intellectual property rights thereto is hereby transferred. Any unauthorized use or reproduction of this software and the documentation may be subject to civil and/or criminal liability. This software is subject to change without notice and should not be construed as a commitment by EMC. Third-Party Licenses This product may include software developed by parties other than RSA. The text of the license agreements applicable to third-party software in this product may be viewed on the product documentation page on RSA Link. By using this product, a user of this product agrees to be fully bound by terms of the license agreements. Note on Encryption Technologies This product may contain encryption technology. Many countries prohibit or restrict the use, import, or export of encryption technologies, and current use, import, and export regulations should be followed when using, importing or exporting this product. Distribution Use, copying, and distribution of any EMC software described in this publication require an applicable software license. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 3

4 Revision History Revision Number Description Version 1.0 Generic SOAP based connector Version 1.1 Added instructions to configure the verifyhostnameforssl property to enable/disable Hostname verification in SSL communication. Version 1.2 Added the feature supported for command capabilities Lock an Account, Unlock an Account Version 1.3 Added the feature for providing the SOAP Action header from UI for each capability 4

5 Preface This guide provides an overview of an out of the box (OOTB) Generic SOAP Connector that can use SOAP to communicate with any Cloud/On-Premise endpoint. The endpoint must support SOAP for provisioning and de-provisioning of entities. This guide helps the user understand the required configurations, parameters, and mappings of different attributes between the connector and any SOAP supported system, and also includes use cases and troubleshooting tips. Supported RSA Identity Governance and Lifecycle versions: RSA Identity Management & Governance version Patch 08 or later RSA Via Lifecycle and Governance version Patch 02 and later RSA Identity Governance and Lifecycle and later Audience This guide is intended for the users of RSA Identity Governance and Lifecycle, including security administrators and administrator who have access to SOAP API configurations on the endpoint. Any system supporting SOAP can be integrated with RSA Identity Governance and Lifecycle using this generic connector. Before using this guide, you should have a solid understanding of SOAP and related concepts. In This Guide How to configure RSA Identity Governance and Lifecycle SOAP Connector for any endpoint supporting SOAP Web Services API Tips and troubleshooting 5

6 Configuring SSL client certificate based authentication SSL based certificate authentication requires a client keystore to be created. To create one, do the following: 1. Create a JKS type client side keystore: a. enter details and the password for the key keytool -genkey -keystore <client keystore name> -storepass <keystore password> -alias <alias name> -keyalg RSA 2. Export the public certificate from above client keystore to.cer file: keytool -export -keystore <client keystore> -storepass <keystore password> -alias <alias for the key> -file <file name ends with.cer> 3. Import/upload the client public certificate file into the server's truststore. To import manually use: keytool -import -keystore <server trustore> -storepass <server truststore password> -alias <alias name for the public certificate> -file <client public certificate ends with.cer> Adding certificates in the keystore for WebLogic Application Server When using SSL for SOAP Web Service Connector on a WebLogic Application server, a SOAP Web Service Connector settings page, or a SOAP endpoint and authority, certificates are also required to be added in the keystore. It will not work if you have provided certificate on Soap Connector for WebLogic AppServer. Certificate needs to be added in keystore for WebLogic AppServer. Follow the steps below for adding certificates to the keystores of WebLogic application server. 1. Download/retrieve certificates and authority (only if required, e.g. ssl certificates in PEM format e.g. endpoint.pem, emc.pem and save them at location /home/oracle 2. Log in to WebLogic Administrative console. ( 3. Click on Servers link in Environment section under Domain Configurations. 4. Click on aveksaserver link. 5. Go to SSL tab 6. Click on Advanced link 7. Select HostName as Verification = None 8. Save the settings. 9. Login into WebLogic machine using SSH (e.g. putty) 10. cd /home/oracle/ 11. Add endpoint.pem and authority (e.g. emc.pem, only if required) certificates in server.keystore by using keytool 6

7 12. Run : keytool -import -file endpoint.pem -alias endpoint -keystore server.keystore -storepass Av3k5a15num83r0n3 13. Run : keytool -import -file <authority_certificate> -alias <alias> -keystore server.keystore - storepass Av3k5a15num83r0n3 14. Restart SSL on WebLogic Server as mentioned below a. Go to Servers -> controls tab b. Select/check aveksaserver(admin) and then click Restart SSL 15. Restart the Server. a. /home/oracle/afx/afx stop b. Run /path/to/weblogic/user_projects/domains/aveksadomain/bin/stopweblogic.sh c. Run /path/to/weblogic/user_projects/domains/aveksadomain/bin/startweblogic.sh d. /home/oracle/afx/afx start Note: You do not need to add Endpoint and authority (only if required) certificates in keystores to use SSL for SOAP Web Service Connector on WildFly and WebSphere application servers. For WildFly and WebSphere, only the information required for SSL is required on the SOAP Web Service Connector settings page. Adding certificates in a default java trust-store for SSL configuration for connectors (cacerts) In the case of SSL (when Server URL uses https protocol), Root or Server/Endpoint certificate should be provided either in a Public Certificate field or must be present in default trust-store (e.g. cacerts). Follow the steps mentioned below for adding certificates to Java keystores (cacerts) of WebSphere, WebLogic and WildFly application servers. 1. Download/retrieve and authority (only if required, ssl certificates in PEM format e.g. example.pem, emc.pem and save them at some location 2. cd $JAVA_HOME/jre/lib/security 3. Add certificates in cacerts by using keytool 4. keytool -import -file example.pem -alias example -keystore cacerts 5. Password for keystore (unless you have made any changes) : changeit 6. Run : keytool -import -file <authority_certificate> -alias <authority_alias> -keystore $JAVA_HOME/jre/lib/security/cacerts storepass changeit 7. Restart ACM and AFX Server 7

8 Setting Hostname verification property -DverifyHostnameForSSL property needs to be set in ACM and AFX server in order to enable/disable Hostname verification. Steps for setting hostname verification property in ACM - WildFly Server: Edit the standalone.conf from /home/oracle/wildfly final/bin to add a property as follows: 1. JAVA_OPTS="$JAVA_OPTS -DverifyHostnameForSSL=false" 2. Save the file and restart the Server. 3. Run: afx stop 4. Run: acm stop 5. Run: acm start 6. Run: afx start Steps for setting hostname verification property in ACM WebLogic Server: 1. Log in to WebLogic Administrative console. ( 2. Under Domain Configurations, in the Environment section, click Servers link. 3. Click aveksaserver link. 4. Click the SSL tab. 5. Click advanced link. 6. Select HostName Verification = None. Save the settings and restart the Server: Login to the VM using Putty as: oracle and password: secret and follow the steps given below: 1. cd /home/oracle/oracle/middleware/user_projects/domains/aveksadomain/bin 2../stopWebLogic.sh 3. nohup./startweblogic.sh & Steps for setting hostname verification property in ACM - WebSphere Server: 1. In the WebSphere Administration Console select Servers. 2. Expand Server Type and select WebSphere application servers. 3. Click on the name of your server. 4. Expand Java and Process Management and select Process Definition. 5. Under the Additional Properties section, click Java Virtual Machine. 6. Scroll down and locate the textbox for Generic JVM arguments. 7. Add property " DverifyHostnameForSSL=false" to JVM and save the configuration. Save the settings and restart the Server. Login to the VM using Putty as: root and password: Av3k5a and follow the steps given below: 1. cd /opt/ibm/websphere/appserver/bin 2. stopserver.sh server1 8

9 3. startserver.sh server1 Steps for setting hostname verification property in AFX: Edit the wrapper.conf file from /home/oracle/afx/esb/conf/ to add a property as follows: wrapper.java.additional.<n>=-dverifyhostnameforssl=false Notes: 1. If DverifyHostnameForSSL=false, hostname verification will be disabled. 2. If DverifyHostnameForSSL=true, hostname verification will be enabled. 3. By default Hostname verification is enabled in both ACM & AFX. Using RSA Identity Governance and Lifecycle SOAP Web Service Connector This connector can be used to communicate with any endpoint providing SOAP support. However, please note there is a specific connector for ServiceNow. Configuration The configuration of the Connector is completed through a number of screens. This section helps you enter the values for each screen. The Connector configuration is made up of three sections: 1. Configure General settings General details about the Connector, such as the name and type. Field Name Value Name <Connector instance name> Description <Connector instance description> Server Select available AFX server Connector Template SOAPWebService State Test/Active Note: When connector testing is completed, change the state to Active. No automated provisioning will occur while in the Test state. Prior to changing to the Active state, we recommend that you test all enabled commands using the Test Connector Settings and 9

10 check Connector Capabilities. Export As Template Use this field If you want to export Connector as Connector template. Connector template will be listed under AFX > Connector Templates. 2. Configure Connection Settings The connection settings are required to connect the RSA Identity Governance and Lifecycle (or RSA IMG) and the endpoint application. Field Name Value Connection Details Server URL <URL of the SOAP instance. e.g. Authentication Type <Authentication scheme required to access SOAP web services> Username <Username for the authentication type basic (with or without SSL)> Password <Password for the authentication type basic (with or without SSL)> Public Certificate <PEM format certificate downloaded from SOAP endpoint> Keystore Path <Client keystore path required for SSL certificate authentication. It is required only when MUTUAL SSL authentication is applicable for SOAP endpoint> E.g. $JAVA_Home/jre/lib/security/cacerts Keystore Password <Client keystore password required for SSL certificate authentication. It is required only when SSL authentication is applicable for SOAP endpoint> Parameters applicable for WS-Security supported applications only All these parameters are used if the endpoint supports the WS security feature. You must enable WS security at endpoints supporting WS security. After enabling WS security at the endpoint, enter the values for these settings. Enable WS-Security <Select check box to enable WS Security> 10

11 Private Key Password <Private Key Password> Private Key <Private key of the certificate uploaded on the SOAP endpoint> Certificate <X.509 Certificate uploaded on SOAP endpoint> Proxy Settings Proxy Host <Hostname of the proxy server> Note: Proxy settings are available in RSA IMG Patch-02 and above Proxy Port <Port of the proxy server> Proxy User Name <User name for the proxy server> Proxy Password <Password for the proxy server> Notes: The private Key size should be greater than or equal to 2048 bits, and the algorithm supported for private key should be RSA Algorithm. In the case of SSL (when Server URL uses https protocol), the Root or Server/Endpoint certificate should be provided either in a Public Certificate field or must be present in default trust-store (e.g. $JAVA_HOME/jre/lib/security/cacerts). (To add Root or Server/Endpoint certificate in default trust-store, please refer to the Adding certificate in default trust-store (cacerts) section. In case Remote AFX is configured and Root or Server/Endpoint certificate is not provided in a Public Certificate field, then the Root or Server/Endpoint certificate should be present in default trust-store of both the servers (ACM & Remote AFX). It is recommended to import certificates in default trust-store if you have certificate chain or more than one certificates, In the case of Mutual SSL Authentication (when Server URL uses https protocol and client authentication is required), the Root or Server/Endpoint certificate should be provided in a Public Certificate field and client keystore location and password should be provided in Keystore Path & Keystore Password fields respectively. 11

12 In case Remote AFX is configured, then client.keystore <client keystore name> file should be created on both the servers (ACM & Remote AFX) and on the same location as well for the following: ACM Server client.keystore location: /home/oracle/client.keystore Remote AFX Server client.keystore location: /home/oracle/client.keystore 3. Configure Capabilities This tab has a list of capabilities supported by this connector. Create an Account Delete an Account Reset an Account Password Add Account to Group Remove Account from Group Enable an Account Disable an Account Update an Account Lock an Account Unlock an Account Add Application Role to Account Remove Application Role from Account Add Role to Account Remove Role from Account Add Entitlement to Account Remove Entitlement from Account Create a Group Delete a Group Add Entitlement to a Group Remove Entitlement from a Group Add Application Role to a Group Remove Application Role from a Group Add a Group to a Group Remove a Group from a Group Add Application Role to an Application Role Remove Application Role from an Application Role Add Entitlement to an Application Role Remove Entitlement from an Application Role Create a Role Delete a Role Change Profile for a Role Disable a Role Enable a Role Add an Application Role to a Role 12

13 Remove an Application Role from a Role Add an Entitlement to a Role Remove an Entitlement Role from a Role Add a Group Entitlement to a Role Remove a Group Entitlement from a Role Each capability listed above has the same configuration, which can be changed as per the endpoint s SOAP support. The following section shows how to configure these capabilities. 13

14 Capabilities Settings For any available capability, these settings are required: 1. Provide input parameters. 2. Provide WSDL URI 3. Click on the Service drop down. 4. available Services will get populated automatically in the Service drop down according to the provided Server a. URL + WSDL URI e.g By selecting required service from the Service drop-down, the Port drop down and namespace field will get populated automatically. a. Select the required port from Port drop down 14

15 6. The optional SOAPAction HTTP request header field can be used to indicate the intent of the SOAP HTTP request. For each operation, SOAPAction is defined in WSDL. Please refer the WSDL to identify the SOAP Action for SOAP request. If the Soap Action field in the connector configuration is left empty, then it is derived from WSDL. For more details refer to the troubleshooting section. 7. Provide the SOAP envelope to call the specified command on the selected port. 8. Response handling: The response to the command call will be a SOAP response message. This can be used to create the proper response for the following fields: Status Code Brief Response Detailed Response. Use Expression type: Status code, XPath or RegEx to evaluate appropriate response fields. 15

16 Status Code: Brief Response: Detailed Response: Please visit this webpage for more details on patterns. 16

17 Example Although this example uses ServiceNow, you can use any other endpoint that supports SOAP as well because both support the SOAP web services used. Setting up SOAP Connector 1. Go to AFX > Connectors. 2. Click the Create Connector button. 3. On the General tab, provide these parameters: Name Description Server Connector Template State Export As Template TestSOAP Connector This is Test SOAP Web Service Connector AFX Server (or any other existing server) SOAPWebService Test TestSOAPConnector 4. Go to the Settings tab and provide the following parameters: Server URL Authentication Type Basic Username <Username for mentioned Server URL> Password <Password for the Username> a. For other settings, keep the default values. As this example does not require WS- Security authentication, all the WS-Security related parameters can be safely ignored and remain blank. 5. Go to the Capabilities tab and configure settings as mentioned in Capabilities Settings section. 6. Save the connector. 17

18 Tips & Troubleshooting This SOAP Connector is based on the SOAP API provided by the SOAP endpoint; any error result returned to RSA Identity Governance and Lifecycle would be in SOAP fault format only and is located in the connector log file, found here: ${AFX}/mule/logs/mule.AFX-CONN-<Connector-Name>.log The SOAP API fault code is comprised of a standard SOAP 1.1 fault code. The SOAP fault string element contains a generic, human readable error message in English. SOAP fault detail element contains miscellaneous information related to the error. For example, if the account already exists, sending a create account command for the same account name results in a SOAP response body with Insert Aborted SOAP fault. <SOAP-ENV:Envelope xmlns:soap-env=" <SOAP-ENV:Header/> <SOAP-ENV:Body> <SOAP-ENV:Fault> </SOAP-ENV:Fault> </SOAP-ENV:Body> </SOAP-ENV:Envelope> <faultcode>soap-env:server</faultcode> <faultstring>com.glide.processors.soap.soapprocessingexception: Insert Aborted : Error during insert of sys_user (??)</faultstring> <detail>com.glide.processors.soap.soapprocessingexception: Insert Aborted: Error during insert of sys_user (??)</detail> However, if the request was successful, the SOAP response body would be: <SOAP-ENV:Envelope xmlns:soap-env=" xmlns:xsd=" xmlns:xsi=" <SOAP-ENV:Body> </SOAP-ENV:Body> <insertresponse xmlns=" </SOAP-ENV:Envelope> <sys_id>40d306514ffb8600a30d7e918110c759</sys_id> <name>testuser testuser</name> </insertresponse> This information is needs to be parsed via XML-XPath querying. The example below explains how to configure XPath on the UI. 18

19 Using the above XML response, to obtain sys_id, configure XPath as: /Envelope/Body/insertResponse/sys_id/ The following table explains the SOAP error response elements. Use this table to troubleshoot issues related to the endpoint while using the Connector. These errors can be observed in Server log files when the Connector is in Active mode, and from the UI while testing capabilities when it is in Test mode: The Brief Response setting can be configured to check the SOAP error response elements. Name Detail Fault Fault code Faultstring Description Container for the key involved in the error Type: Container Ancestor: Body.Fault Container for error information. Type: Container Ancestor: Body The fault code is a string that uniquely identifies an error condition. It is meant to be read and understood by programs that detect and handle errors by type. For more information, see the List of Error Codes. Type: String Ancestor: Body.Fault The fault string contains a generic description of the error condition in English. Simple programs display the message directly to the end user if they encounter an error condition that they cannot handle. Sophisticated programs with more exhaustive error handling and proper internationalization are more likely to ignore the fault string. 19

20 Type: String Ancestor: Body.Fault In case of invalid service, port or namespace provided in the Connector settings, the following error is shown when executing any Capability. Error code = -1 Unexpected exception: Fault encountered handling verb: CreateAccount, error is Missing or bad namespace information, see Details for possibly more information Cause: java.lang.runtimeexception: Fault encountered handling verb: CreateAccount, error is Missing or bad namespace information, see Details for possibly more information To fix this issue, recheck values provided for the particular Capability settings as shown below. In case of invalid WSDL URL provided while configuring a Capability, an error is immediately displayed on screen. 20

21 To correct this issue, make sure that the URL provided is correct. The error message displayed in displays the configured WSDL URL. If you selected Enable WS-Security option under Settings, make sure that a valid private key and X.509 certificates are uploaded on the SOAP instance. If these configurations are missing, an error is displayed when running the connector capability. Error code = -1 Unexpected exception: Fault encountered handling verb: CreateAccount, error is Missing or bad WS-Security Private Key, see Details for possibly more information Cause java.lang.runtimeexception: Fault encountered handling verb: CreateAccount, error is Missing or bad Details for possibly more information WS-Security Private Key, see If you select the Enable WS-Security option on Collector settings, make sure that a valid private key and X.509 certificates are uploaded on the ServiceNow instance. If these configurations are missing, the following error is shown in logs: Collector test failed: com.aveksa.server.runtime.serverexception: Test request failed with response: com.aveksa.server.runtime.serverexception: com.aveksa.common.configexception: For WS-Security Private Key, Private Key Password and Certificate are mandatory Caused By Stack com.aveksa.common.configexception: For WS-Security Private Key, Private Key Password and Certificate are mandatory at Collector test failed: com.aveksa.server.runtime.serverexception: Test request failed with response: com.aveksa.server.runtime.serverexception: com.aveksa.common.configexception: WSSecurity Error.Error while creating KeyStore. Caused by org.apache.commons.ssl.probablybadpasswordexception: Cannot create RSA private key from decrypted stream. Probably bad decryption password. 21

22 com.aveksa.client.component.communication.changelisthandler$changeapplyingrunnable.run(changelis thandler.java:275 If you select the Enable WS-Security option on Collector settings, make sure that on the SOAP instance under Customization Properties for Web Services, the following option is selected: If the Enable WS-Security option on Collector settings is not checked, however on the SOAP instance if the above option is selected on the SOAP instance, then the following error is displayed when running the connector capability- Error code = -1 Unexpected exception: Invalid QName in mapping: wsse:invalidsecurity Cause java.lang.runtimeexception: Invalid QName in mapping: wsse:invalidsecurity To correct this issue, make sure that the Require WS-Security header verification for all incoming SOAP requests option is not selected on the SOAP instance if the Enable WS-Security option on settings is not checked. The endpoint must have SOAP API support enabled. Also, the endpoint should be accessible from the location where RSA Identity Governance and Lifecycle server (AFX) is running. To verify this, make use of any SOAP Client and try any SOAP request from the endpoint s documentation, then check that the response returns status 200 OK. The SOAP connector supports SSL configuration and allows communication over HTTPS protocol. To use secured communication, make sure that the default keystore has the endpoint s certificates added (i.e. corresponding certificate issuing CA should be trusted). If chaining of certificate is required to reach the endpoint from the RSA Identity Governance and Lifecycle instance, ensure that the default keystore has all the required network certificates as well. If the valid certificates are not in the proper keystore, an SSLHandshakeException is displayed: javax.net.ssl.sslhandshakeexception: sun.security.validator.validatorexception: PKIX path building failed: sun.security.provider.certpath.suncertpathbuilderexception: unable to find valid certification path to requested target 22

23 This connector refers to the default certificate location i.e. $JAVA_HOME\jre\lib\security\cacerts When hostname of server certificate and hostname of the URL mismatch SSL connection fails with the following error: java.io.ioexception: The https URL hostname does not match the Common Name (CN) on the server certificate in the client's truststore. Make sure server certificate is correct, or to disable this check (NOT recommended for production) set the CXF client TLS configuration property "disablecncheck" to true OR java.security.cert.certificateexception: No name matching localhost found Hostname verification can be disabled by setting System property DverifyHostnameForSSL. By default Hostname verification is enabled. To enable/disable Hostname verification on different app servers and on AFX server follow instructions present in Setting Hostname verification property section. Problem: Some of the AFX SOAP Connector Capabilities do not work on the endpoint. The request executes successfully, but changes are not reflected on the endpoint. Cause: The SOAP endpoint has WSDL, which contains same request body for multiple SOAP requests. Because of this, the wrong soapaction header gets picked up and sent along with SOAP request. To resolve this problem, provide the soapaction for each SOAP request. SOAP Action The SOAP Action header field can be used to indicate the intent of the SOAP HTTP request. When to use Soap Action: Consider a case where SOAP endpoint has WSDL designated, which contains same request body for multiple SOAP requests. For each SOAP request, SOAP Action is defined in WSDL. The SOAP endpoint decides the request action on basis of "SOAPAction" header value. In the above case, if the SOAP Action header is not provided from the UI, then the wrong SOAP Action header could be used. In the above case, the SOAP Action header should be passed from the UI. How to find SOAP Action Header for SOAP request: There are two ways to find the SOAP Action header: 1. In WSDL, each operation is associated with SOAP Action. 23

24 Ex. ServiceNow User WSDL. <wsdl:operation name="insert"> <soap:operation soapaction= style="document"/> <wsdl:input> <soap:body use="literal"/> </wsdl:input> <wsdl:output> <soap:body use="literal"/> </wsdl:output> </wsdl:operation> 2. Using SOAP UI tool Import WSDL in SOAP UI and configure the authentication type accordingly Select appropriate SOAP request. Provide the details required for SOAP request. Execute the SOAP request. In Raw SOAP request, SOAP Action header for the operation is will present. 24

25 COPYRIGHTS Copyright 2017 Dell Inc. All Rights Reserved. TRADEMARKS RSA, the RSA Logo, and EMC are either registered trademarks or trademarks of Dell Inc. throughout the world. All other trademarks used herein are the property of their respective owners. For the most up-to-date listing of RSA trademarks, go to 25