Configuring a SecurID server

RSA SecurID is based on technology from RSA Security Inc.

Forefront TMG can use SecurID to authenticate clients for access to remote virtual private networks (VPNs), and internal corporate Web servers published through Forefront TMG. To gain access to protected resources, SecurID requires clients to provide their Personal identification number (PIN), and a physical token that produces a time-limited one-time password. Note that both the PIN and the token-generated one-time password are required in order to gain access.

Setting up a SecurID authentication server for Forefront TMG consists of the following steps:

After installing RSA Authentication Manager in accordance with the RSA documentation, create an agent host record to configure the RSA Authentication Manager to accept connections from Forefront TMG for user authentication.
Verify permissions and network adapter settings.
Verify the connection to the RSA Authentication Manager.
Configure SecurID properties.

The following procedures describe how to:

Create an agent host record.
Verify permissions and adapter settings.
Verify the connection.

To create an agent host record

On the computer running RSA Authentication Manager, click Start, and then click RSA Authentication Manager Host Mode.
On the Agent Host menu, click Add Agent Host.
In the Name box, type the name of the computer running Forefront TMG. The name must resolve to an IP address on the local RSA Authentication Manager network.
If required, in the Network address box, type the IP address of the computer running Forefront TMG.
In the Agent type list, click Net OS Agent.
If you want all users to be able to authenticate, select Open to All Locally Known Users.
In Agent Host, click Generate Configuration Files. Click One Agent Host, click OK, double-click the name of the computer running Forefront TMG, and then save the Sdconf.rec file to the %windir%\system32 folder on the computer running Forefront TMG.

Note:

By default, the Sdconf.rec file is located in the ACE\Data folder on the RSA Authentication Manager computer.

Note:
By default, the Sdconf.rec file is located in the ACE\Data folder on the RSA Authentication Manager computer.

To verify permissions and adapter settings

On the computer running Forefront TMG, check that the local Network Service account has read/write access for the following registry key:
HKLM\Software\SDTI\ACECLIENT
This ensures that Forefront TMG is able to write the secret to the registry.
On the computer running Forefront TMG, configure the Network Service account with read permissions for the Sdconfig.rec file.
If the computer running Forefront TMG is configured with multiple network adapters, you should explicitly configure the network adapter address through which Forefront TMG connects to the RSA Authentication Manager for authentication. To do this, specify the IP address as a string value in the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\SDTI\AceClient\PrimaryInterfaceIP
The value specified must match that set in the agent host record.

Verifying the connection

You can test SecurID authentication using the RSA Test Authentication Utility. For more information about the tool, see RSA Test Authentication Utility for Internet Security and Acceleration (ISA) Server (http://www.microsoft.com/downloads/details.aspx?FamilyID=7b0ca409-55d0-4d33-bb3f-1ba4376d5737&DisplayLang=en). This tool checks connectivity between the computer running Forefront TMG and the server running RSA Authentication Manager. The tool can also obtain the secret required for encrypting communications between the servers.