RSA Authentication Manager 6.1 Administrator's Guide - The Ether ...

RSA Authentication Manager 6.1 Administrator’s GuideThe RSA Authentication Manager provides:• Continuous authentication service to Agent Hosts• Offline authentication data to computers whose users are often disconnected fromthe network (computers with RSA Authentication Agent 6.1 only)• Cross-realm authentication services for users visiting from other realms• Administrative functions for the Authentication Manager system (on the Primaryonly—administrative functions are limited on Replicas)• Real-time monitoring of RSA SecurID authentication and administrative activityAutomatic Load BalancingVersion 5.0 (and later) RSA Authentication Agents can do automatic load balancingby polling the Authentication Managers and selecting the one that responds mostquickly to an authentication request. You can also balance the load manually byconfiguring Agents to give higher priority to different Authentication Managers. Formore information, see “Load Balancing by Agent Hosts” on page 69.Authentication Manager and Agent Host Communication ThroughFirewallsAn RSA Authentication Agent Host can use up to three alias Authentication ManagerIP addresses to communicate with an RSA Authentication Manager that is located onthe other side of one or more firewalls. When one of these firewalls intercepts anauthentication request, it recognizes one of the Authentication Manager’s alias IPaddresses and uses an established protocol to match the alias with a valid IP address.For information on setting alias Authentication Manager IP addresses, see theWindows Installation Guide.The configuration file of an Agent Host separated from the Authentication Managerby a firewall must contain the list of available aliases. If you have legacy Agent Hoststhat must authenticate through a firewall, and you want to use an alias IP address thatis not listed in the database as an available alias, you can use the Configuration RecordEditor to edit the Acting Master and Slave Authentication Manager fields in anysdconf.rec file. For more information, see “Legacy Agent Hosts” on page 75.Legacy Agent SupportTwo changes in RSA Authentication Manager 5.0 (and later) architecture improvedauthentication rates over previous major versions: the use of multiple authenticatingReplicas and the ability of the new RSA Authentication Agent software to select theReplica that will respond most quickly to an authentication request. The new Agentsoftware is aware of all the Replicas in your realm and can send authenticationrequests to any one of them.Lacking this ability, Agent Hosts running versions of RSA ACE/Agent software prior to5.0 can authenticate users against only the Master or the Slave, because the Agent Host’sconfiguration file (sdconf.rec) identifies only these two Authentication Managers.For more information about legacy Agent issues, see “Legacy Agent Hosts” on page 75.1: Overview 25