Configure RSA for two factor authentication using SAM Account as LDAP attribute

Products

• VMware vCenter Server

Issue/Introduction

The steps are consolidated to limit the minimum required steps to successfully configure RSA

Symptoms:
The article provides the steps to configure RSA for vCenter authentication.

Environment

VMware vCenter Server 7.0.x
VMware vCenter Server Appliance 6.5.x
VMware vCenter Server Appliance 6.7.x

Resolution

Pre-requisites:

• Validate that the ldap attribute on the RSA is configured with sAMAccountName
• PSC node is configured as standard agent on the RSA Authentication Manager
• Validate that the certificates on the RSA node is trusted by the PSC
• Download the sdconf.rec from the RSA Authentication Manager
• Create the sdopts.rec file in the below format:

USESERVER=<RSA node IP address>
USESERVER=<RSA node IP address>
USESERVER=<RSA node IP address>
USESERVER=<RSA node IP address>
USESERVER=<RSA node IP address>

Note: Please refer to https://community.rsa.com/docs/DOC-46997 for the 'sdopts.rec' configuration

Commands to configure:

./opt/vmware/bin/sso-config.sh -t <SSO Domain> -set_authn_policy -securIDAuthn true
./opt/vmware/bin/sso-config.sh -set_rsa_config -t <SSO Domain> -logLevel DEBUG
./opt/vmware/bin/sso-config.sh -set_rsa_site -t <SSO Domain> -agentName <PSC FQDN> -sdConfFile /root/sdconf.rec -sdOptsFile /root/sdopts.rec
./opt/vmware/bin/sso-config.sh -set_rsa_userid_attr_map -t <SSO Domain> -idsName <Domain name> -ldapAttr sAMAccountName

Validate the Configuration via the below command:

./opt/vmware/bin/sso-config.sh -t vsphere.local -get_rsa_config

Sample Output:

./opt/vmware/bin/sso-config.sh -t vsphere.local -get_rsa_config
Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=256M; support was removed in 8.0
logonGuide:   Passcode for soft token users:<br>Enter only the generated token code from app<br><br>Passcode for hard token users:<br> Enter pin + generated token code
logLevel:   DEBUG
logFileSize:   1
maxLogFileCount:   10
connTimeOut:   60
readTimeOut:   60
encAlgList:   [AES/16, AES/32, AES/24]
idsUserIDAttributeMaps:   {<Domain Name>=sAMAccountName}
Sites [

[siteID:   66918bc1-41ae-4463-9eaf-b1f7c5dba649
agentName:   <PSC FQDN>
sdConfFile:   Binary value
sdOptsFile:   Binary value
]

• Once completed, restart all the services on the PSC and vCenter(external deployment model)
• Log in to the web client of the vCenter and validate configuration

Additional Notes:

In case if the RSA is mis-configured, the below steps needs to be followed to clear it.

• Connect to the PSC node via JXplorer
• Navigate to local->Services->Identitymanager->Tenants-><SSO Domain>
• Delete "RSAAgentConfigurations" under the SSO domain
• Log in to the PSC via ssh and delete "vsphere.local" under "/etc/vmware-sso/" (the folder name would be same as the SSO domain name)
• Reboot the PSC and the vCenter server

Additional Information

Impact/Risks:
Ensure there is a valid backup of all the PSC and vCenter server nodes in case of linked mode deployment model