Skip to content

Integrating SailPoint with RSA Authentication Manager

SailPoint's RSA Authentication Manager connector offers a single point of access management for Users, Groups, and RSA Access Tokens in your RSA Authentication Manager environment.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to Working With Services.

SailPoint's RSA Authentication Manager connector supports the following features:

  • Load and *provision RSA Accounts
  • *Access Certifications (certification of entitlements connected to accounts)
  • *Password management
  • *Partitioned account aggregation
  • PIN reset of token in the new pin mode
  • Delta Aggregation
  • Delete Account

For more information on features, refer to Source Features.

The RSA Authentication Manager source supports multiple group objects.

Feature Users
Aggregate ✔
Create ✔
Authentication ✔
Password Management ✔
Enable/Disable ✔
Group Entitlements (Read, Request, Revoke) Groups, Tokens, Profile

Group Entitlements

Group Entitlements are the entitlement types for which SailPoint provides ability to aggregate additional details of these entitlement types from the managed system. These objects have separate schema defining list of attributes that aggregation task fetches as additional details when aggregation is run for that Group Entitlement type.

Feature Groups Tokens Profiles
Aggregation ✔ ✔ ✔

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

Privilege Level Description
High Administrative level access to accounts
Medium Administrative level access for a specific role or function
Low Only basic access of data

Note

To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to Managing Privilege Classification.

Supported Managed Systems

The RSA Authentication Manager connector supports versions 8.6, 8.7, and 8.8 along with their respective patches.

Prerequisites

Ensure that you perform the following:

Obtaining the Command Client User and Password

RSA Authentication Manager creates a user name and password during installation. This information is used to secure API connections to the command server.

To obtain the command client user name and password:

  1. Open a command prompt on your RSA Authentication Manager host.

  2. Change directories to:

    RSA_AM_HOME/utils

  3. Enter the following command:

    rsautil manage-secrets --action list

  4. When prompted, type your Operations Console user name and password.

    The system displays the list of your internal system passwords.

  5. Locate the values for your command client user name and password. For example:

    Command Client User Name .................: CmdClient_ys0x7d41
Command Client User Password .............: e9SHbK0W4i

Importing the Server Root Certificate (Java)

When RSA Authentication Manager is installed, the system creates a self-signed root certificate and stores it in the RSA_AM_HOME/server/security/server_name.jks directory. This certificate must be exported from the server, and imported into the keystore for remote API clients. Use the Java keytool, as described in the following sections to export and import the certificate into Java clients.

To Export the Server Root Certificate

  1. Change directories to RSA_AM_HOME/appserver/ and enter the following:

    jdk/jre/bin/keytool -export -keystore RSA_AM_HOME/server/security/server_name.jks -file am_root.cer -alias rsa_am_ca

    Where:

    • RSA_AM_HOME directory is a generic placeholder for /opt/rsa/am path
    • - server_name.jks is a placeholder for caStore.jks keystore

  2. At the prompt for keystore_password, press Enter without the password.

    Note

    Ignore the warning message that appears as the server root certificate will still be exported.

To Import the Server Root Certificate (Java)

  1. Locate the server root certificate file that you exported from Authentication Manager. Copy it to the VA location.

Required Permissions

The RSA Authentication Manager connector administrator must have enough rights to execute the requested operation. To assign the rights to the administrator:

  • Assign the default administrative roles present on the RSA. For most of the operations the Auth Mgr Realm Admin administrative role must be assigned.
  • Create new administrative roles with the relevant permissions, assign the role a scope, and then assign it to the administrator. The scope of an administrative role determines in what security domains an administrator may manage objects and from what identity sources an administrator may manage users. The following lists the permissions that can be assigned to the administrative role:
    • All grants an administrator permission to perform any administrative action on the object.
    • Delete grants an administrator permission to delete an object.
    • Add grants an administrator permission to add an object.
    • Edit grants an administrator permission to view and edit an object, but not the ability to add or delete.
    • View grants an administrator permission to view an object, but not to add, edit, or delete.

Minimum Permissions

This section describes the minimum permissions required for roles and custom roles.

Note

By selecting any one of the permission which is mentioned as YES, the respective operations would be Successful.

Administrative Roles / Operations Test Connection Account Aggregation Group Aggregation Provisioning (Create Account from IdentityIQ and Change Password) PIN Reset
Authentication Manager Agent Administrator YES YES YES YES NO
Authentication Manager (Help Desk) YES YES YES YES NO
Authentication Manager Privileged Help Desk YES YES YES NO NO
Authentication Manager Radius Administrator NO NO NO NO NO
Authentication Manager Root Domain Administrator YES YES YES NO NO
Authentication Manager Security Domain Administrator YES YES YES YES YES
Authentication Manager Token Administrator YES YES NO NO YES
Authentication Manager Trust Administrator NO NO NO NO NO
Authentication Manager User Administrator YES YES YES YES NO
Request Approver NO NO NO NO NO
Super Administrator Role YES YES YES YES YES
Token Distributor NO NO NO NO YES
Trusted Realm Administrator Role NO NO NO NO NO

Permissions for Custom Roles

If you do not want to use existing roles, create a custom role and provide the required permissions as described in the table in this topic.

To create custom role:

  1. Go to RSA managed system > Administration > Administrative Role > Manage Existing.
  2. Select Add Administrative Role Name.
  3. In Administrative scope, select Security Domain scope.
  4. Create a custom role.

Assign the following minimum permissions for a custom role:

Operations Permissions Category Permission Name Permission Scope Notes
Test Connection Authentication Permission Authentication Agents View Before an authentication agent can communicate with authentication manager an agent record must exist in the authentication manager data store.
General Permissions Identity Attribute Definition View Data element and directory mappings for user and user group.
Security Domains View Security domain defines area of administrative responsibility. Administrator who can add security domains can create administrative hierarchy with their scope.
Account Aggregation with Group, Role
Group Aggregation		 General Permissions Manage User Group View With VIEW permission, groups would be aggregated.
Manage Users View With VIEW permission, only accounts would be aggregate.
Account Provisioning with Group Membership General Permissions Manage Users Delete, Add, Edit, View With all permissions account would be created and Enable/Disable/Unlock, Reset Password, Terminate session and Users: User Attribute and Mobile Number attributes would be selected.
Users Groups: Assign Membership Yes With this permission user group membership is assigned during account creation.
Users: User Attribute -Mobile Number Modify
Note: For Account - Role assignment operation, Application User requires 'SuperAdmin Role' privileges.
Group Provisioning General Permissions Manage User Group Delete, Add, Edit, View Groups can be Created/Added/Deleted
Token Assignment Authentication Permission SecureID Tokens Delete, Add, Edit, View Select the permission you want to grant to administrators to manage secured ID tokens. Along with this Enable/Disable Tokens, Manage Token Offline Emergency Access, Manage Token Online Emergency Access,RSA SecureID PINs and Resynchronize Tokens would be selected.
SecureID Tokens: Assign Token Yes With this permission Token would be assigned.
SecureID Tokens: Replace Tokens Yes With this permission Token would be replaced.
Token Aggregation Authentication Permission SecureID Tokens View With View permission only Token would be aggregated.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.