RSA SecureID for Two Factor Authentication
Limitations & Important Notes for RSA SecurID Channel:
There is no option to exclude any user from 2FA. If 2FA is enabled on the solution, it must be used by all users.
Keycloak will not manage the 2FA registration for SecurID. Only OTP validation will be handled by Keycloak.
2FA registration on SecurID will be handled by the customer.
All users (including admins) created in Keycloak must be registered for 2FA with SecurID beforehand.
All users must have the same username in both Keycloak and SecurID.
If 2FA is enabled on the solution, each user will be required to enter an OTP during login. If a user does not have access to the OTP, they should contact the Administrator.
For RSA SecurID, the Keycloak Connector manages the OTP validation mechanism. The user must already be registered for 2FA with RSA SecurID. The user will need to enter a 14-character passcode (PIN + Token). The Connector will fetch this passcode and validate it against the RSA Server.
Information Required from RSA Server
Following is the information required from RSA Server to enable two-factor authentication via RSA (SecurID) Authenticator App:
RSA Server URL
This will be the URL of the RSA Server that the Keycloak Connector will communicate with to validate OTPs. For example, https://<rsa-server-domain-name>:<port>/. Don’t forget to add slash / at the end of the URL.
RSA Client Key
This will be the access key required to communicate with RSA Server. RSA also refers to this as Access Key. For example, en7ujo7001g32e3ues48sguo69fetkmdd85hsele82d6641d496zitr56n1b9e6l.
RSA Client ID
This will be the name or ID of the authentication agent responsible for validating the OTPs. For example, authenticator.
All this information can be fetched from RSA Authentication Manager.
Enable 2FA with RSA SecureID
To enable two factor authentication with RSA secureID, update the following environment variables in
efCommonVars_IS_ENABLED_2FA: "true"
efCommonVars_CHANNEL_2FA: "rsa"
efCommonVars_RSA_SERVER_URL: ""
efCommonVars_RSA_CLIENT_KEY: ""
efCommonVars_RSA_CLIENT_ID: ""
Update the efCommonVars_RSA_SERVER_URL, efCommonVars_RSA_CLIENT_KEY, efCommonVars_RSA_CLIENT_ID with the actual values
Deploy the CX Core using default values.
helm upgrade --install --namespace expertflow --create-namespace ef-cx --debug --values helm-values/ef-cx-custom-values.yaml expertflow/cx --version 4.9.3 Disable Two-Factor Authentication
Update below configurations for common variables in
kubernetes/helm-values/ef-cx-custom-values.yaml:
efCommonVars_IS_ENABLED_2FA: "false"Deploy the CX Core using default values.
helm upgrade --install --namespace expertflow --create-namespace ef-cx --debug --values helm-values/ef-cx-custom-values.yaml expertflow/cx --version 4.9.3