Secured by RSA Implementation Guide for Software Token Authenticators

Transcription

1 Secured by RSA Implementation Guide for Software Token Authenticators Partner Information Last Modified: June 30, 2014 Product Information Partner Name Web Site Product Name Version & Platform Product Description Good Technology Version for ios is a secure browser that enables mobile business users to securely access corporate intranets and web applications using their device of choice and allows IT to maintain a high level of security and compliance. is built on the Good Dynamics platform and is included in the Good Collaboration Suite.

2 Solution Summary is Good Technology s next-generation mobile browser that provides business users secure access to corporate intranets and web applications from their ios mobile devices. Good for Enterprise is a secure mobile and collaboration suite that increases employee productivity without compromising security, employee privacy or personal user experience. RSA SecurID customers can use these two mobile applications to transform their employees ios devices into RSA SecurID tokens. Before You Begin This document contains instructions for enabling iphone app s embedded RSA SecurID token. You should have working knowledge of Good Mobile Control, RSA Authentication Manager and RSA software tokens as well as access to the appropriate administrative documentation. Ensure that Good Control and RSA Authentication Manager are running properly prior to configuring the integration. This document is not intended to suggest optimal installations or configurations. Overview RSA Software Token Supported Features for ios RSA SecurID Software Token Automation No File-based Provisioning Yes CTF Provisioning Yes CT-KIP Provisioning No Number of Tokens Supported 1 contains an embedded RSA SecurID authenticator that can generate and display a 6-digit or 8-digit tokencode at 30 or 60-second intervals. In order to initialize a user s authenticator, you must provision an RSA SecurID software token seed record to the user through a secure Good for Enterprise message, and the user must import the seed record into. This process consists of the following sequence of events: Note: End-users must install Good for Enterprise before they can install. An administrator configures an RSA Application Policy for. The policy includes the address of an RSA Authentication Manager administrator who is responsible for assigning and delivering software token seed records. A user activates on his/her ios device, launches the app and requests an RSA SecurID software token seed record. forwards this request to Good for Enterprise. Good for Enterprise generates an request that includes a unique ID for the user s mobile device and the user sends the to the RSA administrator. The RSA administrator assigns a software token to the user, binds it to the user s device ID and s its seed record to the user in an SDTID file or a Compressed Token Format (CTF) URL. Note: The seed record must be delivered in an sdtid file or a CTF URL. The next release will support dynamic seed provisioning (CT-KIP). The user opens the in Good for Enterprise and opens seed record in. imports the seed record and instantiates the RSA SecurID authenticator

3 Product Configuration This section is divided into the following subsections: Configuring a Good Control RSA Application Policy for contains directions for enabling token seed record provisioning in Good Control (intended for administrators). Enabling and Using the RSA SecurID Authenticator contains directions for enabling s embedded RSA SecurID authenticator. (intended for end-users). Configuring a Good Control RSA Application Policy for 1. Log in to the Good Mobile Control console and click the Policy Sets menu item on the left. 2. Locate the policy set you want to configure in the Policy Sets table and click the pencil icon in the Action column. 3. Click the Application Policies tab and expand the policy

4 4. Select the RSA tab and click the Enable RSA SecurID checkbox. 5. must prompt a PINPAD software token user to enter his/her PIN in order to generate an RSA SecurID passcode. If you want to prompt users each time they request a passcode, check the Prompt PIN for PINPAD Token checkbox. Otherwise, will cache the PIN. 6. Enter your RSA Authentication Manager administrator s address in the RSA Administrator Address field. Good Control will send all token seed record requests to this address. 7. If you wish to CC a recipient each time a user requests an RSA SecurID seed record, enter the recipient s address in the RSA Administrator CC Address field. 8. Click the Update button

5 Enabling and Using the RSA SecurID Authenticator Configuring for iphone Configuring for Android Configuring for iphone A iphone end-user must follow the directions below to activate and enable its embedded RSA SecurID authenticator. The instructions assume that you (the administrator) have configured a Good Control RSA application policy for, and that the user has installed Good for Enterprise on his/her device and downloaded the app. 1. Launch the client and click the Setup using your Access Key link. Good Control will an activation key to your Good for Enterprise account. 2. Launch Good for Enterprise, retrieve the activation key from the and launch. 3. Enter your enterprise address in the top field, enter your activation key segments into the remaining three fields and click the Next button. Note: The activation key will contain 15 alphanumeric characters hyphenated into 3 segments. 4. Choose a password, enter it the top and bottom fields and click the Next button. 5. If you wish to allow to send you push notifications, click the OK button. Otherwise, click the Don t Allow button

6 6. will display a blank page in the browser. Tap the list icon in the middle of the ios toolbar (left image), and click the Settings button on the Bookmarks page (right image). 7. Click the Token Passcode button on the Settings page (left image). 8. Click the Send an Request link followed by the Good for Enterprise Auth Delegate button to launch Good for Enterprise

7 9. Good for Enterprise will create an message containing a unique device ID and address it to your RSA Administrator. Click the Send button to request a RSA SecurID token seed record. 10. Your RSA administrator will assign a software token to you, bind it to your device ID and its seed record to you in an SDTID file or a Compressed Token Format (CTF) URL. (The example below shows an SDTID file.) When you receive the , tap the paperclip icon, hold the RSA Secure Device ID button and click the Open In button when it appears. Outgoing Seed Record Request Incoming SDTID Seed Record Response 11. Your ios device will display an icon for each app that is registered to open SDTID files. Click the icon. 12. If your token is password-protected, will display a password prompt. Enter your password and click the OK button. 13. Once you have imported your token, click the Token Passcode button on the Settings page

8 Important: Your tokencode is the random number that your RSA SecurID token generates every 30/60 seconds. Your passcode is a combination of your tokencode and your static PIN (if you have one). If you re using a PINLESS token, your tokencode and passcode are always the same because the token doesn t have an associated PIN. If you re using a FOB-Style token, your passcode is your PIN followed by your tokencode. PINPAD tokens require a user s PIN in order to generate a passcode. If you re using a PINPAD token, will prompt you to enter your PIN before displaying your passcode. 14. If you imported a PINPAD token, will display a keyboard and prompt you to enter a 4 to 8 digit PIN. Otherwise, continue to Step 15. Enter the PIN and click the Done button to display the passcode. If you enter an 8-digit PIN, will display the passcode automatically. Set PIN Prompt: Note: Depending on your RSA Application Policy configuration setting for PINPAD tokens, Good Access may prompt you for your PIN each time you want to access your passcode, or it may prompt you once and cache the PIN for future use. In the latter case, you will be able to clear, set and reset your PIN on the Token Settings page

9 15. If you re using a PINLESS or FOB-Style token, will display your tokencode * directly after Step 13. If you re using a PINPAD token, will use your PIN to generate and display your passcode. Click the button on the left to copy the code and click the button on the right to display the next tokencode. 8-digit Tokencode/Passcode Display: Note: The token display screenshot above shows an 8-digit code that will change in 55 seconds. (There is no way of knowing the software token type from the image.) * Remember, if you re using a PINLESS token, your tokencode is always the same as your passcode

10 16. You can view your token s device ID, nickname (if it has one), serial number and expiration date on the Token Settings page. If you want to view or change information about your token, click the Back button and click the Token Settings button on the Settings page. 17. If you want to enter or change a nickname for your token, tap the Name button and enter the nickname in the text field. 18. If you want to delete your token, swipe the Serial Number field and click the Delete button. Note: If you want to replace your token, you don t need to delete it manually. will delete it automatically before it imports your new seed record. 19. If you re using a PINLESS token and your RSA Application Policy RSA Application Policy allows you to cache your PIN, you can manage your PIN on the Token Settings page. If you want to change your PIN, tap the Change PIN button and follow the prompts. You ll need to enter your current PIN before creating a new one. 20. If you want to clear your PIN, tap the Clear PIN button. Once you do, will remove the Change PIN and Clear PIN buttons and replace them with a button labeled Set PIN

11 21. If you don t want to display your PIN when you enter it, set the Mask PIN Entry toggle button to ON

12 Configuring for Android A - Android end-user must follow the directions below to activate and enable its embedded RSA SecurID authenticator. The instructions assume that you (the administrator) have configured a Good Control RSA application policy for, and that the user has installed Good for Enterprise on his/her Android device and downloaded the Android application. 1. Launch the client and click the Setup using your Access Key link. Good Control will an activation key to your Good for Enterprise account. 2. Launch Good for Enterprise, retrieve the activation key from the and launch. 3. Enter your enterprise address in the top field, enter your activation key segments into the remaining three fields and click the Next button. Note: The activation key will contain 15 alphanumeric characters hyphenated into 3 segments. 4. Choose a password, enter it the top and bottom fields and click the Next button. 5. If you wish to allow to send you push notifications, click the OK button. Otherwise, click the Don t Allow button

13 6. will display a blank page in the browser. Tap the menu button on action bar. 7. Click the Token Passcode button on the dropdown Menu (left image). 8. Click the Send an Request will launch Good for Enterprise. 9. Good for Enterprise will create an message containing a unique device ID, and address it to your RSA Administrator. Click the Send button to request a RSA SecurID token seed record

14 10. Your RSA administrator will assign a software token to you, bind it to your device ID and its seed record to you in an SDTID file or a Compressed Token Format (CTF) URL. When you receive the , tap the paperclip icon, hold the RSA Secure Device ID button and click the Open In button when it appears. Outgoing Seed Record Request Incoming SDTID Seed Record Response 11. Your Android device will display an icon for each app that is registered to open SDTID files. Click the icon. 12. If your token is password-protected, will display a password prompt. Enter your password and click the OK button

15 Note: If enter the wrong password, Good access will continue to prompt you until you either enter the correct one or exceed your failure count limit. In the later case, you will need to reinstall in order to import the token. You may, however, import a new token. 13. Once you have imported your token, click the Token Passcode button on the browser s dropdown menu page. Important: Your tokencode is the random number that your RSA SecurID token generates every 30/60 seconds. Your passcode is a combination of your tokencode and your static PIN (if you have one). - If you re using a PINLESS token, your tokencode and passcode are always the same because the token doesn t have an associated PIN. - If you re using a FOB-Style token, your passcode is your PIN followed by your tokencode - PINPAD tokens require a user s PIN in order to generate a passcode. If you re using a PINPAD token, it will prompt you to enter your PIN before displaying your passcode 14. If you imported a PINPAD token, will display a keyboard and prompt you to enter a 4 to 8 digit PIN. Otherwise, continue to Step 15. Enter the PIN and click the Done button to display the passcode. If you enter an 8-digit PIN, will display the passcode automatically. Set PIN Prompt: Confirm PIN Prompt:

16 15. If you re using a PINLESS or FOB-Style token, will display your tokencode after Step 13. If you re using a PINPAD token, will use your PIN to generate and display your passcode. Click the Copy Code button to copy the code and the Next Code button to display the next tokencode. 8-digit Tokencode/Passcode Display: Note: The token display screenshot above shows an 8-digit code that will change in 26 seconds. (There is no way of knowing the software token type from the image.) 16. You can view your token s device ID, nickname (if it has one), serial number and expiration date on the Token Settings page. If you want to view or change information about your token, click the Back button and click the Token Settings button on the Settings page. 17. If you want to enter or change a nickname for your token, tap the Name button and enter the nickname in the text field. Remember if you re using a PINLESS token, your tokencode is always the same as your passcode

17 18. If you want to delete your token, swipe the Serial Number field and click the Delete button. Note: If you want to replace your token, you don t need to delete it manually. will delete it automatically before it imports your new seed record. 19. If you re using a PINLESS token, and your RSA Application Policy RSA Application Policy allows you to cache your PIN, you can manage your PIN on the Token Settings page. If you want to change your PIN, tap the Change PIN button and follow the prompts. You ll need to enter your current PIN before creating a new one. 20. If you want to clear your PIN, tap the Clear PIN button. Once you do, will remove the Change PIN and Clear PIN buttons and replace them with a button labeled Set PIN. 21. If you don t want to display your PIN when you enter it, set the Mask PIN Entry toggle button to ON

18 RSA SecurID Authenticator Screens (iphone) 8-digit Passcode:

19 6-digit Passcode Display with Nickname:

20 RSA SecurID Authenticator Screens (Android) 8-digit Passcode:

21 6-digit Passcode Display with Nickname:

22 Certification Checklist for RSA Authenticators (ios) Date Tested: May 14, 2014 Certification Environment Product Name Version Information Operating System RSA Software Token ios SDK 1.5 ios Good Control 1.6 NA ios Good for Enterprise ios RSA Software Token Provisioning Functionality File-Based Provisioning CT-KIP Provisioning CTF Provisioning Multiple Token Support Password-Protected Token Support Replace Token on Import Supported Token Types PINLESS FOB-Style PINPAD General Functionality Display Next Tokencode Copy Passcode/Tokencode Delete Token (manually) RSA Software Token Functionality PINPAD Functionality Prompt for PIN (uncached) Cache PIN Change/Clear PIN Available Token Information Token Serial Number Token Expiration Date Device ID JGS / PAR = Pass = Fail N/A = Not Applicable to Integration

23 Certification Checklist for RSA Authenticators (Android) Date Tested: June 19, 2014 Certification Environment Product Name Version Information Operating System RSA Software Token Android SDK 1.2 Android Good Control 1.6 NA 1.1 ios Good for Enterprise 2.4 ios RSA Software Token Provisioning Functionality File-Based Provisioning CT-KIP Provisioning CTF Provisioning Multiple Token Support Password-Protected Token Support Replace Token on Import Supported Token Types PINLESS FOB-Style PINPAD General Functionality Display Next Tokencode Copy Passcode/Tokencode Delete Token (manually) RSA Software Token Functionality PINPAD Functionality Prompt for PIN (uncached) Cache PIN Change/Clear PIN Available Token Information Token Serial Number Token Expiration Date Device ID JGS / PAR = Pass = Fail N/A = Not Applicable to Integration