RSA Authentication Manager 7.1 Administrator's Guide - IT Services ...

RSA Authentication Manager 7.1 Administrator’s Guide
For many organizations, automatic contact lists are sufficient. However, you may
choose to create a manual contact list if you have a specific way that you want to route
authentication requests.
For example, suppose that you are an administrator at a company that has Boston,
New York, and San Jose locations. The New York and San Jose locations are small
and all authentications are routed to Authentication Manager replica instances at each
site. The Boston location, however, is largest, and the primary instance at that location
handles all of your Boston location users, as well as all VPN requests from external
users. You may choose to create a manual contact list that routes authentication
requests to all of your server nodes, except the database sever. This leaves the
database server free to replicate data to your replica instances in New York and San
Jose.
For instructions, see the Security Console Help topics, “Manage the
RSA Authentication Manager Contact List,” “Assign a Contact List to an
Authentication Agent,” and “Edit Manual Contact Lists.”
Using Authentication Agents to Restrict User Access
Authentication Manager allows you to configure authentication agents in two ways:
Unrestricted agents. Unrestricted agents process all authentication requests from
all users in the same realm as the agent. They eliminate the need to grant access to
user groups on the agent.
Restricted agents. Restricted agents only process authentication requests from
users who are members of user groups that have been granted access to the agent.
Users who are not members of a permitted user group cannot use the restricted
agent to authenticate.
For example, when an authentication request comes from a restricted agent,
Authentication Manager checks to see if the request comes from a user that is a
member of a user group that is granted access to the agent. If a user is a member,
he or she is authenticated and access is granted. If a user is not a member, he or
she is not authenticated and access is denied.
You can grant access to existing user groups, or you can create new user groups
specifically for use with restricted agents.
Important: Active Directory supports multiple types of groups. When
configured to use Active Directory groups, Authentication Manager only
supports Universal groups. When you view the Active Directory groups from
the Security Console, the Security Console displays all groups, regardless of
type. If you select a group from this list to activate users on restricted agents,
make sure that you select a Universal group. Use the Active Directory Users
and Computers MMC Console to examine the type of group. If you use any
other type of Active Directory group, the user cannot authenticate.
3: Protecting Network Resources with RSA SecurID 73