<Partner Name> <Partner Product> RSA SECURID ACCESS Implementation Guide. PingIdentity PingFederate 8

Transcription

1 <Partner Name> <Partner Product> RSA SECURID ACCESS Implementation Guide PingIdentity John Sammon & Gina Salvalzo, RSA Partner Engineering Last Modified: February 27 th, 2018

2 Solution Summary Ping Identity PingFederate can integrate with RSA Cloud Authentication Service using SAML. When integrated, PingFederate can challenge users with policy and context driven multifactor authentication. Note: PingFederate cannot chain an external SAML IdP to an external SAML SP. Therefore it is only possible to use RSA Cloud Authentication service as a SAML Identity Provider for SP applications using SSO technologies other than SAML. Ping Identity PingFederate can integrate with RSA Authentication Manager using PingFederate RSA SecurID Integration Kit. When integrated, PingFederate can challenge users with RSA SecurID and/or Risk Based Authentication. On Premise Methods RSA SecurID On Demand Authentication Risk-Based Authentication (AM) Cloud Authentication Service Methods Authenticate App FIDO Token SSO RSA SecurID Access Features Ping Identity SAML SSO - HFED SSO - Identity Assurance Collect Device Assurance and User Behavior

3 Supported Authentication Methods by Integration Point This section indicates which authentication methods are supported by integration point. The next section (Configuration Summary) contains links to the appropriate configuration sections for each integration point. Ping Identity PingFederate integration with RSA Cloud Authentication Service Authentication Methods REST IDR SAML Cloud SAML HFED RADIUS RSA SecurID LDAP Password Authenticate Approve Authenticate Tokencode Device Biometrics SMS Tokencode Voice Tokencode FIDO Token - - Ping Identity PingFederate integration with RSA Authentication Manager Authentication Methods REST RADIUS UDP Agent TCP Agent RSA SecurID AM RBA - Supported - Not supported n/t Not yet tested or documented, but may be possible

4 Configuration Summary All of the supported use cases of RSA SecurID Access with Ping Identity PingFederate require both server-side and client-side configuration changes. This section of the guide includes links to the appropriate sections for configuring both sides for each use case. RSA Cloud Authentication Service Ping Identity PingFederate can be integrated with RSA Cloud Authentication Service in the following way: SAML via RSA Cloud (IdP) Cloud Authentication Service Cloud IdP Configuration PingFederate SAML Configuration RSA Authentication Manager Ping Identity PingFederate can be integrated with RSA Authentication Manager in the following ways: UDP Agent Authentication Manager UDP Agent Configuration PingFederate UDP Agent Configuration Risk-Based Authentication Authentication Manager Risk-Based Configuration PingFederate Risk-Based Authentication Configuration

5 RSA SecurID Access Configuration RSA Cloud Authentication Service Configuration SAML via RSA Cloud (IdP) To configure a SAML Service Provider in RSA Cloud IdP, you must add a Service Provider for in the RSA SecurID Access Console. During configuration of the IdP you will need some information from the SP. This information includes (but is not limited to) Assertion Consumer Service URL and Service Provider Entity ID. 1. Logon to the RSA SecurID Access console and browse to Authentication Clients > Service Providers. Click to Add a Service Provider. 2. Click the Add a Service Provider button on the Service Providers page. 3. Enter a name for the Service Provider in the Name field on the Basic Information page. 4. Click the Next Step button. 5. On the Authentication page, in this example we have selected RSA SecurID Access manages all authentication. 6. From the Access Policy pulldown select password-only a policy that was previously configure. 7. Select Next Step

6 8. On the Connection Profile page, select Choose File and select the Ping Identity metadata file. 9. Select Import Metadata. 10. Once the metadata is imported the Assertion Consumer Service URL and Service Provider Entity ID fields will populate

7 11. In the Message Protection section, select Choose File add the SP signing certificate if required. 12. Select the Download Certificate and provide the IdP certificate to the service provider. 13. Click Save and Finish. 14. Select the Edit pulldown list and choice View or Download IdP Metadata. 15. Select Download Metadata File and send this file to Ping Identity

8 Refer to the PingFederate SAML Configuration section for instructions on how to configure the service provider for SAML SSO

9 RSA Authentication Manager Configuration UDP Agent To configure your RSA Authentication Manager for use with a UDP-based agent, you must create an agent host record in the Security console of your Authentication Manager and download its configuration file (sdconf.rec). Hostname: Configure the agent host record name to match the hostname of the agent. IP Address: Configure the agent host record to match the IP address of the agent. Important: Authentication Manager must be able to resolve the IP address from the hostname. Risk-Based Authentication To configure your RSA Authentication Manager for risk-based authentication with PingFederate, you must create an agent host record and enable it for risk-based authentication in the RSA Authentication Manager Security Console. You will need to download the sdconf.rec and the risk-based authentication integration script for the appropriate device type to configure the agent. RSA Authentication Manager can integrate risk-based authentication with UDP-based or RADIUS agents only. The latest risk-based authentication script template is at the following link &arg12=downloaddirect&transaction=signon&quiet=true Download this file and copy it to the following directory in your primary RSA Authentication Manager server. /opt/rsa/am/utils/rba-agents Please refer to RSA documentation for more information on RBA integration scripts

10 Partner Product Configuration Before You Begin This section provides instructions for configuring the PingFederate with RSA SecurID Access. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to install the required components. All PingFederate components must be installed and working prior to the integration. Perform the necessary tests to confirm that this is true before proceeding. PingFederate SAML Configuration Please refer to the following documentation. PingFederate as the SP: dpmetadata.html#concept_importingidpmetadata PingFederate UDP Agent Configuration Complete the steps in this section to integrate with RSA SecurID Access using UDP-based agent protocol. 1. Download the PingFederate RSA SecurID Integration Kit from Ping Identity s website and place it in a temporary directory. If you have trouble locating the kit, contact Ping Identity Customer Support. 2. Log in to the RSA Authentication Manager Security Console, download the server s sdconf.rec file and save the file to a temporary directory. 3. Create a test user and assign an RSA SecurID token to the user. 4. Stop the PingFederate server if it is running. 5. Copy the pf-securid-adapter-1.2.jar and pf-securid-images.war files from the RSA SecurID integration kit s dist directory and paste them into the <PF-install>/server/default/deploy directory. 6. Copy the RSA SecurID API files, authapi.jar (included in the kit) and cryptoj.jar (available at RSA SecurCare Online), and paste them into the <PF-install>/server/default/lib directory. 7. Copy the remaining files from the dist directory, paste them into the <PFinstall>/server/default/conf/template directory and start the PingFederate server

11 8. Log in to the administrative console and click the Adapters link in the IdP Configuration section. 9. Click the Create New Instance button on the Manage IdP Adapter Instances page. 10. Choose a descriptive name for the adapter and enter it into the Instance Name field. 11. Choose a unique, alphanumeric string for PingFederate to use to identify the adapter and enter it into the Adapter Instance field. The string may not contain whitespaces. 12. Select SecurID Authentication Adapter from the Type dropdown list and click the Next button. 13. Click the Browse button to the right of the SecurID Configuration File field, navigate to your temporary directory and select the sdconf.rec file. 14. Enter the RSA SecurID test user s username in the Test Username field. You will submit the user s username and tokencode to RSA Authentication Manager for verification. Important: You must have the test user s RSA SecurID token before you proceed. You will submit the user s credentials to RSA Authentication Manager for validation (See Step 16). Upon a successful authentication, the adapter will write a node secret to PingFederate s adapter-config folder. If the adapter fails to save the node secret, you must create one and import it manually. See the Appendix for details

12 15. Click the Show Advanced Fields button and review the adapter s optional configuration settings. See the Appendix for details. 16. Enter the user s RSA SecurID tokencode into the Test Passcode field and click the Next button. PingFederate will submit the credentials to RSA Authentication Manager for verification. 17. Click the Next button on the Adapters screen. 18. Select the Pseudonym checkbox on the Adapter Attributes screen and click the Next button. 19. Verify your configuration settings on the Summary screen and click the Done button. 20. Click the Save button on the Manage IdP Adapter Instances screen. This concludes the adapter s configuration process. You may now configure or modify your SP connection(s) to use the RSA SecurID Adapter instance. See the PingFederate Administrator s Manual for details. PingFederate Risk Based Authentication Configuration Complete the steps in this section to integrate with RSA SecurID Access using Risk-based authentication. Verify that PingFederate is integrated and tested via UDP-based agent before proceeding. 1. Stop the PingFederate server if it is running. 2. Navigate to the <PF-install>/dist/template directory, open the file named SecurIDAuthenticationAdapter.form.template.html and locate the closing head tag (</head>): 3. Copy the following HTML <script> tag and paste it before the closing head tag above. <script language="javascript"> 4. Paste the contents of the am_integration.js file after the <script> tag above and paste the closing </script> tag below directly after it. </script>

13 5. Locate the opening body tag: <body id="loginbody"> and replace it with the following body tag: <body id="loginbody" onload="javascript:redirecttoidp();"> 6. Start the PingFederate server

14 Login Screenshots Login screen: User-defined New PIN:

15 System-generated New PIN: Next Tokencode:

16 Certification Checklist for RSA SecurID Access Certification Environment Details: RSA Authentication Manager 8.1 SP1 RSA Authentication Agent API Ping Identity.0, Red Hat Linux 5 RSA Cloud Authentication Service Authentication Method Date Tested: not tested REST RADIUS Client Client RSA SecurID - - LDAP Password - - Authenticate Approve - - Authenticate Tokencode - - Device Biometrics - - SMS Tokencode - - Voice Tokencode - - FIDO Token - RSA Authentication Manager Authentication Method Date Tested: October 9 th 2015 REST UDP TCP RADIUS Client Agent Agent Client RSA SecurID RSA SecurID Software Token Automation On Demand Authentication Risk-Based Authentication - = Passed, X = Failed, - = N/A

17 Known Issues To enable the adapter in a cluster, you must configure PingFederate to use sticky sessions If you plan to deploy the RSA SecurID Adapter in a PingFederate server cluster, you must configure the server s load balancer to use sticky sessions. (For more information about deploying PingFederate in a cluster, see the PingFederate Server Clustering Guide.) PingFederate displays an inaccurate message when a user violates a PIN reuse requirement You may configure an RSA Authentication Manager token policy to restrict users from reusing SecurID PINs. If a user violates a token policy s PIN reuse requirement, the PingFederate client won t instruct the user to choose a unique PIN. Instead, the client will display an Access Denied message, which implies that the user has failed authentication. The user will need to authenticate again before given another chance to set a new PIN. Ping Identity is aware of the issue and plans to address it in a future release. Important: Inform users that if they receive an Access Denied message after they submit a new PIN, they have violated a PIN reuse requirement. Instruct them to authenticate again and choose a unique PIN when prompted. RSA Authentication Manager does not consider this to be a failed authentication attempt

18 Appendix RSA SecurID Access Integration Details Partner Integration Details RSA Authentication Agent API (UDP) RSA Authentication Agent API (TCP) RSA SecurID Authentication API (REST) RSA SecurID User Specification Display RSA Server Info Perform Test Authentication Agent Tracing Dependent on version of Agent SDK N/A N/A All users No Yes No RSA Authentication Agent Files (C and Java Agents only) RSA SecurID Authentication Files UDP Agent Files sdconf.rec sdopts.rec Node secret sdstatus.12 / jastatus.12 Location <pf_home>/pingfederate/server/default/data/adapter-config/ <pf_home>/pingfederate/server/default/data/adapter-config/ <pf_home>/pingfederate/server/default/data/adapter-config/ <pf_home>/pingfederate/server/default/data/adapter-config/ TCP Agent Files rsa_api.properties sdconf.rec sdopts.rec Node secret Location N/A N/A N/A N/A Review File Locations Node Secret: The RSA Authentication Manager node secret is stored in the PingFederate s <pf_home>/pingfederate/server/default/data/adapter-config/ directory in a file named securid. In order clear the node secret: 1. Delete the node secret file (securid) from the adapter-config directory above and log in to the RSA Authentication Manager Security Console. 2. Locate your PingFederate agent in the Authentication Agents table, click the arrow to the right of its hostname and select Manage Note Secret from the dropdown menu. 3. Select the Clear Node Secret checkbox and click the Save button. 4. Return to the PingFederate administrative console and continue configuring the adapter

19 Important: If the test authentication fails to create a node secret, you must create a new one and install it manually. See the instructions below for details. sdconf.rec: The sdconf.rec file is stored in PingFederate s <pf_home>/pingfederate/server/default/data/adapterconfig/ directory. Use the PingFederate administrative console to manage this file. sdstatus.12: The sdstatus.12 file is stored in PingFederate s <pf_home>/pingfederate/server/default/data/adapterconfig/ directory. sdopts.rec: The sdopts.rec file is stored in PingFederate s <pf_home>/pingfederate/server/default/data/adapterconfig/ directory. Use the PingFederate administrative console to manage this file. Set RSA SecurID Adapter Advanced Options When you click the Show Advanced Fields button on the IdP Adapter configuration screen, the page will expand to display the following optional fields:

20 The table below contains descriptions of each field. See PingFederate documentation for more details. Field Name Description SecurID Node Secret If your test authentication fails to create a node secret, export a new node secret from the RSA Authentication Manager Security Console, save it locally and set the SecurID Node Secret field to its local path. See the directions below for details. SecurID Optional Configuration Challenge Retries Logout Path Logout Redirect Logout Template If you need to upload a SecurID Optional Configuration File (sdopts.rec), save the file in a temporary directory, click the Browse button to the right of the SecurID Optional Configuration field, locate the temporary directory and select the file. If you wish to limit the amount of consecutive failed login attempts the adapter will allow a user before denying access, set the Challenge Retries field to the limit you choose. This value must be less than or equal to any RSA Authentication Manager policy limits. See the RSA Authentication Manager Administrative Guide for information. If your SaaS provider doesn t support SAML Single Log-Out, you can set the Logout Path field to a path on the PingFederate server that will terminate an IdP SSO session after a user logs out of the SaaS provider s service. You may set the Logout Redirect field to a URL on your SP application where the adapter should redirect users to after they log out. The adapter will only use this field if the Logout Path field has been set. You may set the Logout Template field to the name of an HTML template the adapter to display when a user logs out. The template must be stored in the <PF-install>/server/default/conf/template directory. The adapter will only use this field if the Logout Path field is set and either the Logout Redirect field hasn t been set or a logout redirection fails. Upload a Node Secret Manually Follow the instructions below if you need to set the node secret manually: 1. If you are attempting to replace an existing node secret, delete the securid file from the <pf_home>/pingfederate/server/default/data/adapter-config/ directory. 2. Log in to the RSA Authentication Manager Security Console. 3. Locate your PingFederate agent in the Authentication Agents table, click the arrow to the right of its hostname and select Manage Note Secret from the dropdown menu. 4. Check the Create Node Secret checkbox, enter a password in the Encryption Password and Confirm Encryption Password fields and click the Save button. 5. Click the link to download the node secret file (<AgentName>_NodeSecret.zip), save it to a temporary directory and unzip it. You will see a file named nodesecret.rec

21 6. Copy the nodesecret.rec file to a temporary directory on your PingFederate server and navigate to that directory from a command line prompt. 7. Issue the following command to load the node secret: /rsa/agent_nsload -f nodesecret.rec -d <pf_home>/pingfederate/server/default/data/adapter-config/ Important: This example assumes that the agent_nsload utility is installed in the /rsa directory on your PingFederate server. If it is installed in another directory, run the command from that directory instead. If you can t locate the utility, contact PingFederate or RSA Customer Support. 8. When prompted for a password, enter the encryption password you set above. 9. Return to the PingFederate s IdP Adapter configuration screen, click the Show Advanced Fields button and set the RSA SecurID Node Secret field. 10. Continue configuring the adapter