Pulse Secure Policy Secure

Transcription

1 Policy Secure RSA SecurID Ready Implementation Guide Last Modified: November 19, 2014 Partner Information Product Information Partner Name Pulse Secure Web Site Product Name Policy Secure Version & Platform 5.0 R7.1 Product Description Policy Secure is a mobility-ready network access control and BYOD solution that resides on the network & protects enterprises by seamless enforcement of security policies for all users, devices and applications accessing the enterprise.

2 Solution Summary Policy Secure is a standards-based, scalable solution for adaptive access control that reduces threat exposure and mitigates risks. It protects your network, guarding mission-critical applications and sensitive data while providing comprehensive control, visibility, and monitoring capabilities. Policy Secure appliances can be configured to support RSA SecurID two-factor authentication over the RSA Authentication Manager native protocol and the RADIUS standard protocol. Both integrations allow organizations to further secure their resources by requiring end-users to authenticate with RSA SecurID hardware or software tokens. Both integrations may also be configured to enable token automation for RSA Software token users and SID800 hardware users. During the token automation login process, a user only needs to submit a username and PIN, and the system provides the RSA SecurID tokencode in the background. Policy Secure also supports RSA Risk-Based Authentication (RBA). Risk-Based Authentication strengthens RSA SecurID authentication and traditional password-based authentication by analyzing a user s behavior and device to identify potentially risky or fraudulent authentication attempts. If the assessed risk is unacceptable, RSA Authentication Manager will challenge the user with a secondary authentication method to further confirm the user s identity. RSA SecurID supported features RSA SecurID Authentication via Native RSA SecurID Protocol RSA SecurID Authentication via RADIUS Protocol On-Demand Authentication via Native SecurID Protocol On-Demand Authentication via RADIUS Protocol Risk-Based Authentication RSA Authentication Manager Replica Support Secondary RADIUS Server Support RSA SecurID Software Token Automation RSA SecurID SD800 Token Automation RSA SecurID Protection of Administrative Interface Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes 2

3 Authentication Agent Configuration RSA Authentication Agents are custom or ready-made software applications that securely pass user authentication requests to and from RSA Authentication Manager. RSA provides the RSA Authentication Agent API for building custom agents, as well as a variety of out-of-the-box agents for protecting access to various operating systems and web resources. All agents must be registered with RSA Authentication Manager in order for the server to locate them and establish secure communication channels with them. Use the RSA Security Console to register an agent for each Policy Secure appliance in your environment. You need the following information to register a Policy Secure agent: the hostname of the Policy Secure appliance IP addresses for all of the Policy Secure appliance s network interfaces When you register an authentication agent, set its agent type to Standard Agent. Note: Hostnames must resolve to valid IP addresses on the local network. If you are configuring a RADIUS integration, you must use the RSA Security Console to create a RADIUS client for each of your agents. You will need the following information to create a Policy Secure RADIUS client: the hostname of the Policy Secure appliance IP addresses for all of the Policy Secure appliance s network interfaces the RSA RADIUS server s secret Consult the RSA Authentication Manager Administrator Guide for more information about authentication agents and RADIUS clients. RSA SecurID files RSA SecurID Authentication Files Files sdconf.rec Node Secret sdstatus.12 sdopts.rec Location In Memory In Memory In Memory Not implemented Note: The appendix of this document contains more detailed information regarding these files. 3

4 Partner Product Configuration Before You Begin This section provides instructions for enabling RSA SecurID two-factor authentication for Policy Secure users. You should have working knowledge of the Policy Secure platform and RSA Authentication Manager, as well as access to the appropriate end-user and administrative documentation. Ensure that both products are running properly prior to configuring the integration. Note: This document is not intended to suggest optimal installations or configurations. Policy Secure RSA SecurID Authentication Configuration Policy Secure supports RSA SecurID authentication over the RSA Authentication Manager protocol and the RADIUS protocol. Follow the instructions in the appropriate section based on your requirements: Native RSA SecurID Authentication Configuration RADIUS Authentication Configuration Native RSA SecurID Authentication Configuration 1. Log in to your RSA Security Console and download the server s sdconf.rec configuration file. 2. Log in to the Policy Secure administration console ( 3. Expand the Authentication menu and click the Auth. Servers link. 4. Choose ACE Server from the dropdown list and click the New Server button. 4

5 5. When the New Ace Server screen appears, enter a name for the server in the Name text field, and enter its port number in the ACE Port text field (5500 is the default). 6. Select the checkbox labeled Users authenticate using tokens or one-time passwords. 7. Click the Browse button to the left of the Import new config file field, locate and select the sdconf.rec you downloaded and click the Open button. 8. Click the Save Changes button. 9. Expand the Users User Realms menu and click the New User Realm link. 5

6 10. Enter a name for the realm in the Name text field and select your RSA Authentication Manager server instance from the Authentication dropdown list. 11. Click the Save Changes button. 6

7 12. The system will automatically display the Role Mapping tab. Click the New Rule button and create one or more rules to further restrict access to the new realm based on your requirements. 13. Click the Save Changes button. 14. Expand the Authentication Signing In menu and click the Sign-in Policies link. 15. Click the New URL button on the Sign-In Policies tab. 16. Select the appropriate User Type radio button based on your authentication policy requirements. 17. Enter the URL for a given service in the Sign-In URL text field. 18. Select the realm you created from the Available Realms list and click the Add button. 7

8 19. Click the Save Changes button. Note: Follow the same to procedure to enable RSA SecurID authentication for administrative users, but configure Admin Realms and sign-in policies instead of User Realms and sign-in policies. 8

9 RADIUS RSA SecurID Authentication Configuration Note: Refer to the RSA Authentication Manager Installation Guide for more information about configuring Authentication Manager as a RADIUS server. 1. Log in to your RSA Security Console and download the server s sdconf.rec configuration file. 2. Log in to the Policy Secure administration console ( 3. Expand the Authentication menu and click the Auth. Servers link. 4. Choose RADIUS Server from the dropdown list and click the New Server button. 5. When the New RADIUS Server screen appears, enter a name for the server in the Name text field 6. Enter the RSA Authentication Manager RADIUS server s IP address or hostname in the RADIUS Server text field. 7. Enter the RADIUS server s port number in the Authentication Port text field (1812 is the default). 8. Enter the RADIUS server s shared secret in the Shared Secret text field. 9. Enter the RADIUS server s accounting port in the Accounting Port text field (1813 is the default). 10. Enter the amount of seconds that the system should attempt to establish a connection with the RADIUS server in the Timeout text field. 11. Enter the number of times the system should attempt to connect to the RADIUS server in the Retries text field. 12. Select the checkbox labeled Users authenticate using tokens or one-time passwords. 9

10 13. If you have configured more than one RSA Authentication Manager RADIUS servers, enter the server s connection information in the Backup Server section. 14. Click the Save Changes button. 10

11 15. Expand the Users User Realms menu and click the New User Realm link. 16. Enter a unique name for the realm in the Name text field. 17. Select your RADIUS authentication server instance from the Authentication dropdown list and from the Accounting dropdown list. 18. The system will automatically display the Role Mapping tab. Click the New Rule button and create one or more rules to further restrict access to the new realm based on your requirements. 19. Click the Save Changes button. 11

12 20. The system will automatically display the Role Mapping tab. Click the New Rule button and create one or more rules to further restrict access to the new realm based on your requirements. 21. Click the Save Changes button 22. Expand the Authentication Signing In menu and click the Sign-in Policies link. 23. Click the New URL button on the Sign-In Policies tab. 24. Select the appropriate User Type radio button based on your authentication policy requirements. 25. Enter the URL for a given service in the Sign-In URL text field. 26. Select the realm you created from the Available Realms list and click the Add button. 12

13 27. Click the Save Changes button. Note: Follow the same to procedure to enable RSA SecurID authentication for administrative users, but configure Admin Realms and sign-in policies instead of User Realms and sign-in policies. 13

14 Policy Secure RSA SoftID Sign-In Configuration Note: The Software Token integration doesn t support system-generated PINs or on-demand tokens. The Policy Secure platform provides a set of custom login pages that support RSA SecurID token automation in conjunction with the RSA Software Token application. When a user browses to a page that has been configured for token automation, the system prompts the user for a username and an RSA SecurID PIN. When the user submits these credentials, Policy Secure s authentication process activates a web browser plugin that reads a tokencode from the user s local RSA Software Token application and passes the username, PIN and tokencode to the RSA Authentication Manager server. Policy Secure Configuration 1. Log in to the Policy Secure administration console ( 2. Expand the Authentication Signing In menu and click the Sign-in Pages link. 3. Click the Upload Custom Pages button on the Sign-in Pages tab. 4. Click the Softid link on the right side of the page to download a ZIP file (softid.zip) that contains a set of software token login page templates. 14

15 5. Enter a name for the set of pages in the Name field. 6. Click the Browse button to the right of the Templates File field, locate and select the softid.zip file you downloaded and click the Open button. 7. Click the Upload Custom Pages button. 8. Click the Save Changes button. 9. Expand the Authentication Sign In menu and click the Sign-in Policies link. 15

16 10. Click the New URL button on the Sign-In Policies tab. 11. Select the appropriate User Type radio button based on your authentication policy requirements. 12. Enter the URL for a given Policy Secure resource in the Sign-In URL text field and select the name you gave to the software token pages from the Sign-In Page dropdown list. 16

17 13. Select a realm that supports RSA SecurID authentication (via the RSA Authentication Manager native protocol or RADIUS) from the Available Realms dropdown list and click the Add button. Important: You can only select a single authentication realm, and that realm must support RSA SecurID authentication using either the RSA Authentication Manager or RADIUS protocols. 14. Click the Save Changes button. 17

18 RSA Software Token / SID800 Authenticator Configuration Note: The Software Token integration doesn t support system-generated PINs or on-demand tokens. Follow the steps below to enable software and/or SID800 hardware token automation on a Policy Secure end-user s computer. 1. Log on to the user s computer, launch the RSA Software Token with Automation installer, choose the Custom Setup radio button and click the Next button. You can also launch this installer directly from the SID800 client installer. Important: If you are installing the RSA Software Token version 4.1.1, you must use the RSA SecurID Software Token with Automation installer. If you are installing an earlier version, or version (64-bit) use the standard RSA SecurID Software Token installer. 2. Expand the Browser Plug-ins feature, select to install one or both of the web-browser plugins and click the Next button. Each plugin communicates with the RSA Software Token application to enable token automation on its respective browser (Internet Explorer or Firefox). 3. Click the Install button. After the application has been installed, software token automation will be enabled on the user s computer. If wish to configure SID800 automation, continue to step Install the RSA Authentication Client 3.6.x. 5. Insert a SID800 token into the client computer s USB port. 6. Launch the software token application and ensure that it recognizes the SID800 device. 18

19 Risk-Based Authentication Configuration Important: RBA isn t supported in a Policy Secure clustered environment. If you plan to enable RSA Risk-Based Authentication (RBA) for Policy Secure, you have to configure RSA SecurID authentication first. Once you have done so, follow the instructions below. Note: In order for an application to support RBA, it must also support RSA SecurID authentication. Before you configure RBA for Policy Secure, make sure you have enabled RSA SecurID over either the RSA Authentication Manager protocol or RADIUS. RBA does not require RSA SecurID tokens. To enable RBA for Policy Secure, you must generate a JavaScript file from a custom template, deploy it on your Policy Secure appliance and modify Policy Secure s standard RSA SecurID login page. Install or Update the Policy Secure RBA Template 1. Download the Policy Secure RBA integration script template and save it to a temporary directory: 2=downloaddirect&transaction=signon&quiet=true 2. Connect to your RSA Authentication Manager server s virtual appliance using an SCP or SSH client, navigate to the /opt/rsa/am/utils/rba-agents directory and see if it contains a Policy Secure template. The template will be named Pulse_Policy_Secure_<version>.xml. 3. If you find a Policy Secure RBA template, and it s same as or newer than the one you downloaded, skip step 4 and continue to the Generate the Policy Secure RBA JavaScript File section. 4. Upload the Pulse_Policy_Secure_5.xml file from your temporary directory to the /opt/rsa/am/utils/rbaagents directory and disconnect your SCP/SSH client session. Generate the Policy Secure RBA JavaScript File 1. Log in to the RSA Authentication Manager Security Console, open your Policy Secure agent for editing, scroll to the Risk-based Authentication section and check the Enable this Agent for riskbased authentication checkbox. 2. Set the access restriction and authentication method options based on your requirements and click the Save agent & Go to Download Page button. 3. Select Pulse Policy Secure 5.0 from the Agent Type list box and click the Download File button. 4. RSA Authentication Manager will generate a JavaScript file named am_integration.js. Copy the file to a temporary directory for later use. 19

20 Configure a Custom Sign-In Page for Risk-Based Authentication 1. Log in to the Policy Secure administration console. 2. Expand the Authentication menu, click the Signing In link, select the Sign-in Pages tab and click the Upload Custom Pages button. 3. Click the Sample link on the right side of the page to download a ZIP file (sample.zip) that contains a set of login page templates. 4. Unzip the sample.zip file to a temporary directory, open the LoginPage.thtml file for editing and locate the closing body tag (</body>). 20

21 5. Copy the following HTML <script> tags and paste them before the </body> tag above: <script src='<% Home %>/am_integration.js' type="text/javascript"></script> <script>window.onload=redirecttoidp;</script> 6. Copy the am_integration.js file that you generated into the directory that contains the sample templates and create a new ZIP file from the contents of the directory. Important: ZIP the contents of the temporary directory, not the directory itself. 7. Enter a name for the set of pages in the Name field. 8. Click the Choose File button, locate and select your new ZIP file (rba.zip in this example) and click the Open button. 9. Click the Upload Custom Pages button, select the Sign-In Policies tab and click the New URL button 10. Select the appropriate User Type radio button based on your authentication policy requirements, choose a Policy Secure URL you wish to protect with RBA and enter it in the Sign-In URL text field. 21

22 11. Select the name you gave to the RBA login pages from the Sign-In Page dropdown list. 12. Select a realm that supports RSA SecurID authentication (via the RSA Authentication Manager native protocol or RADIUS) from the Available Realms dropdown list and click the Add button. Important: You can only select a single authentication realm, and that realm must support RSA SecurID authentication using either the RSA Authentication Manager or RADIUS protocols. 13. Click the Save Changes button. 22

23 RSA SecurID Login Screens Standard Logon Prompt New PIN Mode Prompt 23

24 Confirm System Generated PIN Prompt New System Generated PIN Mode Prompt Next Tokencode Prompt 24

25 Automated Token Standard Logon Prompt Automated Token New PIN Mode Prompt Automated Token Next Tokencode Progress Bar 25

26 RSA RBA Login Screens RBA User ID Logon Prompt: RBA Password Logon Prompt: 26

27 RBA Challenge Question Logon Prompt: RBA Device-Binding Option Prompt: 27

28 Certification Checklist for RSA Authentication Manager Date Tested: November 12, 2014 Certification Environment Product Name Version Information Operating System RSA Authentication Manager 8.1 Virtual Appliance Policy Secure 5.0 R appliance RSA Software Token with Automation Windows 7 RSA Remote Authentication Client 3.6 Windows 7 RSA Native Protocol New PIN Mode Force Authentication After New PIN System Generated PIN User Defined (4-8 Alphanumeric) User Defined (5-7 Numeric) Deny 4 and 8 Digit PIN Deny Alphanumeric PIN Deny PIN Reuse Passcode 16-Digit Passcode 4-Digit Fixed Passcode Next Tokencode Mode Next Tokencode Mode On-Demand Authentication On-Demand Authentication On-Demand New PIN Load Balancing / Reliability Testing Failover (3-10 Replicas) No RSA Authentication Manager Mandatory Functionality RADIUS Protocol Force Authentication After New PIN System Generated PIN User Defined (4-8 Alphanumeric) User Defined (5-7 Numeric) Deny 4 and 8 Digit PIN Deny Alphanumeric PIN Deny PIN Reuse 16-Digit Passcode 4-Digit Fixed Passcode Next Tokencode Mode On-Demand Authentication On-Demand New PIN Failover No RSA Authentication Manager JGS = Pass = Fail N/A = Not Applicable to Integration 28

29 Certification Checklist for RSA Authentication Manager Date Tested: November 20, 2014 RSA Risk-Based Authentication Functionality RSA Native Protocol RADIUS Protocol Risk-Based Authentication Risk-Based Authentication Risk-Based Authentication Risk-Based Authentication with SSO N/A Risk-Based Authentication with SSO N/A JGS = Pass = Fail N/A = Not Applicable to Integration RSA Software Token Automation Functionality RSA Native Protocol RADIUS Protocol PINless Token Next Tokencode Mode PINpad-style Token Deny Alphabetic PIN Next Tokencode Mode Fob-style Token 16-Digit Passcode Alphanumeric PIN Next Tokencode Mode Other System-Generated PIN Password-Protected Token Next Tokencode Mode Deny Alphabetic PIN Next Tokencode Mode 16-Digit Passcode Alphanumeric PIN Next Tokencode Mode System-Generated PIN Password-Protected Token JGS = Pass = Fail N/A = Not Applicable to Integration RSA SecurID 800 Token Automation Functionality RSA Native Protocol RADIUS Protocol PINless Mode 14-Digit Passcode User-Defined PIN System-Generated PIN Next Tokencode Mode PINless Mode 14-Digit Passcode User-Defined PIN System-Generated PIN Next Tokencode Mode JGS = Pass = Fail N/A = Not Applicable to Integration 29

30 Known Issues The RADIUS integration doesn t support RSA Securid System-Generated PINs. The Policy Secure RADIUS integration doesn t support system-generated PINs. A user whose token policy requires system generated PINs will be denied access when his/her token enters New PIN Mode. If you use the RADIUS integration, ensure that users are allowed to choose their PINs, or instruct them to use the RSA Self-Service Console when they need a new system-generated PIN. If you require systemgenerated PINs and don t wish to rely on the Self-Service Console, you must use the RSA Authentication Manager native integration. The Software Token integration doesn t support System-Generated PINs. The Policy Secure Software Token integration doesn t support system-generated PINs. When a user enters system-generated new PIN mode, the client will submit the PIN without displaying it. Although this will result in a successful authentication, it will prevent the user from authenticating in the future. If you use the Software Token integration, ensure that users are allowed to choose their PINs, or instruct them to use the RSA Self-Service Console when they need a new system-generated PIN. The Software Token integration doesn t support RSA On-Demand tokens. The Connect Secure Software Token integration doesn t support on-demand tokens. The Software Token integration displays inaccurate New PIN Mode requirements The Software Token integration only accepts numeric PINs in new PIN mode. It instructs users to enter a numeric PIN when their tokens enter new PIN mode, regardless of your organization s PIN policy rules.. If you use the Software Token integration, you must set your must configure your policy rules to require numeric PINs, This issue has been reported to Pulse Secure. RBA isn t supported in a clustered environment. RSA Risk-Based Authentication isn t supported in a Policy Secure clustered environment. Pulse Secure and RSA are working on a solution to this issue. 30

31 Appendix Partner Integration Details RSA SecurID API RSA Authentication Agent Type RSA SecurID User Specification Display RSA Server Info Perform Test Authentication Agent Tracing 8.1 SP1 Standard Agent Designated Users No No No Node Secret: To delete the node secret on the appliance: 1. Log in to the Policy Secure administration console ( 2. Expand the Authentication menu and click the Auth. Servers link. 3. Click your server s link in the Authentication/Authorization Servers column 4. Select the checkbox labeled this node in the Node Verification File section and click the Delete button. 5. Click the Save Changes button. sdconf.rec: To replace the sdconf.rec on the appliance: 1. Log into your RSA Security Console and download the server s sdconf.rec configuration file. 2. Log in to Policy Secure administration console ( 3. Expand the Authentication menu and click the Auth. Servers link. 4. Click your server s link in the Authentication/Authorization Servers column. 5. Click the Browse button to the left of the Import new config file field text field, locate and select the sdconf.rec you downloaded and click the Open button. 6. Click the Save Changes button. 31