RSA On-demand authentication method generates a unique, time-based one-time password (OTP) at the server using the short message service (SMS)
To enable the above features you have to install at least RSA 7.1 and have a On-Demand license.
Configuration in the RSA Server
This post describes RSA Authentication Manager 7.1 with RADIUS server installed on a Windows
2003 R2 server. The RSA server has a LDAP mapping to Active Directory for authenticating users.
To configure SMS token delivery you need some kind of method to send SMS messages. RSA and
Clickatell have partnered to enable delivery of SecurID tokencodes to mobile devices via SMS/text. RSA
Authentication 7.1 has a build-in method for delivering SMS messages through Clickatell.
- To obtain a free trial and further information please refer to below link:
http://www.clickatell.com/rsa/securid.php
Configuration in the Juniper IVE:
a. User enters regular credentials
b. SA sends Radius Access Request with these credentials to radius server
c. Radius server validates the credentials and sends Access Challenge to SA
d. SA presents another page to user
e. User types the OTP/SMS based password/string/etc
f. SA sends this back to Radius and allows/denies login based on what the Radius server sends
(accept/reject)
Step 1: Create a New RADIUS Server in the Juniper IVE ~ SA
Step 2: Create a custom new RADIUS Rule:
Step 3: Add a value that matches the value returned by Radius Server in Access Challenge packet
What is the "value" to put in radius rule? This is the real point... (.*) don't work
ReplyDeletethank you for the post.. in this case, you need to take the TCP Dump via Juniper IVE and check what attributes are send from the RADIUS Server. This value works for maximum number of cases. If issue persists provide me TCP Dump so that i can help or contact JTAC for support.
ReplyDeleteI try to explain what I need to do:
ReplyDeleteA sign-in page on the IVE where user needs to put only "username" or "username" and "pin" IVE send the request with username to radius(that is RSA auth.manager) radius check the "Mobile" attribute of the LDAP user and sends an SMS to the user mobile through the clickatell plugin... I don't get how I can achieve this because if I select the radius auth. as main authentication realm, the IVE sign-in page expects 2 fields to submit...
Hi David,
ReplyDeleteThank you for the post.
1. To configure RSA on Demand, configure the RADIUS Server in the Juniper IVE.
2. User will login using username and password
3. Configure Challenge in the RADIUS Server
4. Once the Primary authentication is successful then IVE will prompt for Challenge window usually "Yellow color" window and on the same time user will receive sms on the mobile phone.
5. Take TCP Dump via Juniper IVE
Troubleshooting > TCP Dump and filter for IP Address of the RADIUS Server and check if the IVE receive the Challenge packet or not or the Primary authentication is successful or not.
6. Trust me TCP Dump will help us to troubleshoot these issues. Do refer to User Access Logs to check for error messages.
Paste me the TCP Dump update.. or provide me the TCP Dump on the Email ID
my email: dhr.tech@gmail.com
just for reference :
TCP Dump flow :
Access Request
Access Accept / Reject / Access Challenge
*************
If you receive Reject then it means that primary authentication is failing..
*************
cont..
Access Request
Access Accept
This complete flow conclude that user has logged in successfully.
for more details on RADIUS Server refer to Juniper IVE's Admin guide
kb.juniper.net
Hope this helps..
Regards,
Dhruv
JNCIA,JNCIS,CCNA,MCP,RSA