RSA Authentication Manager 7.1 Administrator's Guide - IT Services ...

RSA Authentication Manager 7.1 Administrator’s Guide
Enabling and Disabling Tokens
As an administrator, one of your tasks is enabling and disabling tokens so that they
can be assigned to users and used for authentication. Enabled and disabled are terms
that describe the token’s authentication status. An enabled token can be used for
authentication, but a disabled token cannot.
After Authentication Manager is installed, tokens must be imported into the system.
All imported tokens are automatically disabled. This is a security feature that protects
the system in the event that the tokens are lost or stolen.
Note: A disabled token does not refer to a token belonging to a user who has been
locked out of the system. Disabling a token is done manually, by the administrator,
and means that the token cannot be used for authentication. Lockout applies to a user’s
account, not a user’s token.
You can manually enable and disable tokens on the Edit Token page in the Security
Console. You must enable a token before it can be used for authentication.
Important: Tokens are automatically enabled when first assigned to a user.
In these situations, you should disable a token after it has been assigned to a user:
• When it is going to be mailed or delivered to a user. Re-enable the token when
you know that it has been successfully delivered to the user to whom it has been
assigned.
• If you know that the user to whom the token is assigned does not need to
authenticate for some period of time. For example, you may want to disable a
token belonging to a user who is going away on short-term leave or extended
vacation. Once you disable the token, that user cannot authenticate with the token
until the token is re-enabled.
Note: Disabling a token does not remove it from the system. Disabled tokens can be
viewed using the Security Console.
For example, assume that one of your users is taking a one-time leave of absence.
Although the user will be out of the office for one month, the user will need the ability
to authenticate upon returning to work. Since the user’s account is going to be inactive
for one month, you disable the user’s token and the user’s account during that time
period. When the user returns to work, you enable the user’s account and the user’s
token so that the user can authenticate and access the resources protected by
Authentication Manager.
Note: You can only enable and disable tokens in security domains that are included in
your administrative scope.
For instructions, see the Security Console Help topics “Enable Tokens” and “Disable
Tokens.”
102 4: Administering Users