7.1

Option Action
Connector
Address
Enter the IP address of the connector instance. The value you enter must match the value you used
when you added the connector appliance as an authentication agent to the RSA SecurID server. If
your RSA SecurID server has a value assigned to the Alternate IP address prompt, enter that value
as the connector IP address. If no alternate IP address is assigned, enter the value assigned to the IP
address prompt.
Agent IP
Address
Enter the value assigned to the IP address prompt in the RSA SecurID server.
Server
Conguration
Upload the RSA SecurID server conguration le. First, you must download the compressed le
from the RSA SecurID server and extract the server conguration le, which by default is named
sdconf.rec.
Node Secret Leaving the node secret eld blank allows the node secret to auto generate. It is recommended that
you clear the node secret le on the RSA SecurID server and intentionally do not upload the node
secret le. Ensure that the node secret le on the RSA SecurID server and on the server connector
instance always match. If you change the node secret at one location, change it at the other location.
6 Click Save.
What to do next
Add the authentication method to the default access policy. Navigate to Administration > Directories
Management > Policies and click Edit Default Policy to edit the default policy rules to add the SecurID
authentication method to the rule in the correct authentication order.
Configuring RADIUS for Directories Management
You can congure Directories Management so that users are required to use RADIUS (Remote
Authentication Dial-In User Service) authentication. You congure the RADIUS server information on the
Directories Management service.
RADIUS support oers a wide range of alternative two-factor token-based authentication options. Because
two-factor authentication solutions, such as RADIUS, work with authentication managers installed on
separate servers, you must have the RADIUS server congured and accessible to the identity manager
service.
When users sign in to their My Apps portal and RADIUS authentication is enabled, a special login dialog
box appears in the browser. Users enter their RADUS authentication user name and passcode in the login
dialog box. If the RADIUS server issues an access challenge, the identity manager service displays a dialog
box prompting for a second passcode. Currently support for RADIUS challenges is limited to prompting for
text input.
After a user enters credentials in the dialog box, the RADIUS server can send an SMS text message or email,
or text using some other out-of-band mechanism to the user's cell phone with a code. The user can enter this
text and code into the login dialog box to complete the authentication.
If the RADIUS server provides the ability to import users from Active Directory, end users might rst be
prompted to supply Active Directory credentials before being prompted for a RADIUS authentication
username and passcode.
Prepare the RADIUS Server
Set up the RADIUS server and then congure it to accept RADIUS requests from the
Directories Management service.
Refer to your RADIUS vendor's setup guides for information about seing up the RADIUS server. Note
your RADIUS conguration information as you use this information when you congure RADIUS in the
service. To view the type of RADIUS information required to congure Directories Management see
“Congure RADIUS Authentication in Directories Management,” on page 105.
Configuring vRealize Automation
104 VMware, Inc.