AnsweredAssumed Answered

RSA Security Console - remove 'domain name' input needed while authentication

Question asked by Sabi Swaminathan on Sep 11, 2020
Latest reply on Sep 14, 2020 by Edward Davis

Like • Show 0 Likes0
Comment • 4

Hi,

Can someone please help me with below situation,

We have a Citrix external gateway with RSA Secure ID as 2FA for user authentication and in our current Citrix external logon page users need to input Domain name + User name in user name field. i.e 'Domain\UserName'

We have configured and removed Domain name input from Citrix Netscaler level but RSA looks to be needing Domain name in username filed.

can someone please point out the steps to remove 'domain name' input needed while authentication - RSA Security Console.

No one else has this question

Outcomes

4 Replies

David Allison Sep 11, 2020 9:45 AM
Mark Correct
Correct Answer
Try using RSAOMIT to remove the domain credentials; see this article for the how-to: 000029392 - How to ignore username's NTLM or "down-level logon name" domain name prefix sent by a radius client or agent in RSA Authentication Manager 8.x
Like • Show 1 Like1
Actions
Edward Davis Sep 11, 2020 11:18 AM
Mark Correct
Correct Answer
a) How are users listed in RSA Security Console ?

short userid like joeuser, or UPN style like joeuser@domain.com ?

b) How are usernames arriving at the RSA server from the agent ?

-joeuser
-domain/joeuser
-joeuser@domain.com

c) NTLM name stripping or RSAOMIT can take an incoming name with domain
attached, and strip it down to remove the domain, or map it to UPN.

This is designed to allow RSA windows agents to send domain of a user to RSA Server in this format:
domain/userid

and map it to userid@domain.com, or with RSAOMIT, remove just the domain/ part and not map to anything.

-incoming domain/joeuser can be stripped to joeuser if that is how users are listed (RSAOMIT)
-incoming domain/joeuser can be mapped to UPN joeuser@domain.com

d) If the userid arrives as joeuser, but users are listed in Sec Console as joeuser@domain.com, it cannot
be mapped to add the @domain.com to joeuser.

At any rate the authentication activity log will show the format of the username as it arrives at the RSA
server, and we need to find a match in the list of users in the Security Console that either is identical, or
if not identical, if the NTLM mapping can make it match, that can be used.
Like • Show 1 Like1
Actions
Sabi Swaminathan Sep 11, 2020 9:44 PM
Mark Correct
Correct Answer
Hi Edward and David - thanks for your reply,
1. we have user listed as userid@domain.com in security console
2. So I tried to adding RSAOMIT In the section for Domain Name Mapping, it did not work.
3. I tried removing the existing Domain mapping field names and that did not work, as per authentication logs this is what I get
Currently normal authentication works without changing Domain Name Mapping

Is there anything else I can try ?
Like • Show 0 Likes0
Actions
- Edward Davis @ Sabi Swaminathan on Sep 14, 2020 7:57 AM
  Mark Correct
  Correct Answer
  Your incoming usernames must be joeuser@domain.com. If you are just sending the short name 'joeuser', RSA AM server doesn't have a way to add @domain.com to the user automatically.
  
  options
  
  You could set up login aliases for the users, and apply those to agents that are not sending the domain name across. So, set up an alias 'joeuser' for actual user joeuser@domain.com, and apply this to the citrix agent, and when the system sees joeuser try to authenticate from a specific agent it will check if this is an alias for real user joeuser@domain.com and authenticate.
  
  or
  
  you could list all users in the database by short name....if on an LDAP connection you can change the userid mapping from UPN to samaccount name, and all the users would switch to the short userid. But of course this may affect other things and not be possible or easy to do.
  Like • Show 0 Likes0
  Actions

RSA Security Console - remove 'domain name' input needed while authentication

Outcomes

Related Content

Recommended Content