# Integrating SailPoint with RSA Authentication Manager SailPoint's RSA Authentication Manager connector offers a single point of access management for Users, Groups, and RSA Access Tokens in your RSA Authentication Manager environment. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to [Working With Services](). SailPoint's RSA Authentication Manager connector supports the following features: - Load and \*provision RSA Accounts - \*Access Certifications (certification of entitlements connected to accounts) - \*Password management - \*Partitioned account aggregation - PIN reset of token in the new pin mode - Delta Aggregation - Delete Account For more information on features, refer to [Source Features](). The RSA Authentication Manager source supports multiple group objects. | Feature | Users | | --- | --- | | Aggregate | ✔ | | Create | ✔ | | Authentication | ✔ | | Password Management | ✔ | | Enable/Disable | ✔ | | Group Entitlements (Read, Request, Revoke) | Groups, Tokens, Profile | ### Group Entitlements Group Entitlements are the entitlement types for which SailPoint provides ability to aggregate additional details of these entitlement types from the managed system. These objects have separate schema defining list of attributes that aggregation task fetches as additional details when aggregation is run for that Group Entitlement type. | Feature | Groups | Tokens | Profiles | | --- | --- | --- | --- | | Aggregation | ✔ | ✔ | ✔ | ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ## Supported Managed Systems The RSA Authentication Manager connector supports versions 8.6, 8.7, and 8.8 along with their respective patches. ## Prerequisites Ensure that you perform the following: - Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](). - Meet the requirements necessary to support [TLS communication]() in the virtual appliance you plan to use with this source. - Ensure that a valid TLS certificate is present in the correct directory. For example: `/home/sailpoint/certificates` - [Obtain the Command Client User and Password](<#obtaining-the-command-client-user-and-password>). - [Import the Server Root Certificate (Java)](<#importing-the-server-root-certificate-java>). > **Note** > > SailPoint Support may require access to your RSA Authentication Manager test or development environment for assistance. ### Obtaining the Command Client User and Password RSA Authentication Manager creates a user name and password during installation. This information is used to secure API connections to the command server. To obtain the command client user name and password: 1. Open a command prompt on your RSA Authentication Manager host. 2. Change directories to: `RSA_AM_HOME/utils` 3. Enter the following command: `rsautil manage-secrets --action list` 4. When prompted, type your Operations Console user name and password. *The system displays the list of your internal system passwords.* 5. Locate the values for your command client user name and password. For example: ```text Command Client User Name .................: CmdClient_ys0x7d41 Command Client User Password .............: e9SHbK0W4i ``` ### Importing the Server Root Certificate (Java) When RSA Authentication Manager is installed, the system creates a self-signed root certificate and stores it in the `RSA_AM_HOME/server/security/server_name.jks` directory. This certificate must be exported from the server, and imported into the keystore for remote API clients. Use the Java keytool, as described in the following sections to export and import the certificate into Java clients. #### To Export the Server Root Certificate 1. Change directories to `RSA_AM_HOME/appserver/` and enter the following: `jdk/jre/bin/keytool -export -keystore RSA_AM_HOME/server/security/server_name.jks -file am_root.cer -alias rsa_am_ca` Where: - `RSA_AM_HOME` directory is a generic placeholder for `/opt/rsa/am` path - `- server_name.jks` is a placeholder for `caStore.jks` keystore 2. At the prompt for **keystore\_password**, press **Enter** without the password. > **Note** > > Ignore the warning message that appears as the server root certificate will still be exported. #### To Import the Server Root Certificate (Java) 1. Locate the server root certificate file that you exported from Authentication Manager. Copy it to the VA location. ## Required Permissions The RSA Authentication Manager connector administrator must have enough rights to execute the requested operation. To assign the rights to the administrator: - Assign the default administrative roles present on the RSA. For most of the operations the **Auth Mgr Realm Admin** administrative role must be assigned. - Create new administrative roles with the relevant permissions, assign the role a scope, and then assign it to the administrator. The scope of an administrative role determines in what security domains an administrator may manage objects and from what identity sources an administrator may manage users. The following lists the permissions that can be assigned to the administrative role: - **All** grants an administrator permission to perform any administrative action on the object. - **Delete** grants an administrator permission to delete an object. - **Add** grants an administrator permission to add an object. - **Edit** grants an administrator permission to view and edit an object, but not the ability to add or delete. - **View** grants an administrator permission to view an object, but not to add, edit, or delete. ### Minimum Permissions This section describes the minimum permissions required for roles and custom roles. > [!NOTE] > > By selecting any one of the permission which is mentioned as YES, the respective operations would be Successful. | Administrative Roles / Operations | Test Connection | Account Aggregation | Group Aggregation | Provisioning (Create Account from IdentityIQ and Change Password) | PIN Reset | | --- | --- | --- | --- | --- | --- | | Authentication Manager Agent Administrator | YES | YES | YES | YES | NO | | Authentication Manager (Help Desk) | YES | YES | YES | YES | NO | | Authentication Manager Privileged Help Desk | YES | YES | YES | NO | NO | | Authentication Manager Radius Administrator | NO | NO | NO | NO | NO | | Authentication Manager Root Domain Administrator | YES | YES | YES | NO | NO | | Authentication Manager Security Domain Administrator | YES | YES | YES | YES | YES | | Authentication Manager Token Administrator | YES | YES | NO | NO | YES | | Authentication Manager Trust Administrator | NO | NO | NO | NO | NO | | Authentication Manager User Administrator | YES | YES | YES | YES | NO | | Request Approver | NO | NO | NO | NO | NO | | Super Administrator Role | YES | YES | YES | YES | YES | | Token Distributor | NO | NO | NO | NO | YES | | Trusted Realm Administrator Role | NO | NO | NO | NO | NO | ### Permissions for Custom Roles If you do not want to use existing roles, create a custom role and provide the required permissions as described in the table in this topic. To create custom role: 1. Go to **RSA managed system \> Administration \> Administrative Role \> Manage Existing**. 2. Select **Add Administrative Role Name**. 3. In **Administrative scope**, select **Security Domain scope**. 4. Create a custom role. Assign the following minimum permissions for a custom role:
Operations Permissions Category Permission Name Permission Scope Notes
Test Connection Authentication Permission Authentication Agents View Before an authentication agent can communicate with authentication manager an agent record must exist in the authentication manager data store.
General Permissions Identity Attribute Definition View Data element and directory mappings for user and user group.
Security Domains View Security domain defines area of administrative responsibility. Administrator who can add security domains can create administrative hierarchy with their scope.
Account Aggregation with Group, Role
Group Aggregation		 General Permissions Manage User Group View With VIEW permission, groups would be aggregated.
Manage Users View With VIEW permission, only accounts would be aggregate.
Account Provisioning with Group Membership General Permissions Manage Users Delete, Add, Edit, View With all permissions account would be created and Enable/Disable/Unlock, Reset Password, Terminate session and Users: User Attribute and Mobile Number attributes would be selected.
Users Groups: Assign Membership Yes With this permission user group membership is assigned during account creation.
Users: User Attribute -Mobile Number Modify
Note: For Account - Role assignment operation, Application User requires 'SuperAdmin Role' privileges.
Group Provisioning General Permissions Manage User Group Delete, Add, Edit, View Groups can be Created/Added/Deleted
Token Assignment Authentication Permission SecureID Tokens Delete, Add, Edit, View Select the permission you want to grant to administrators to manage secured ID tokens. Along with this Enable/Disable Tokens, Manage Token Offline Emergency Access, Manage Token Online Emergency Access,RSA SecureID PINs and Resynchronize Tokens would be selected.
SecureID Tokens: Assign Token Yes With this permission Token would be assigned.
SecureID Tokens: Replace Tokens Yes With this permission Token would be replaced.
Token Aggregation Authentication Permission SecureID Tokens View With View permission only Token would be aggregated.