Configuring External OTP Tokens

Hardware Requirements

Each user needs a SecurID token. The tokens are powered by an integral battery and require no user maintenance. Tokens last between 2-5 years. There is no reader; the passcode is entered like a password, along with an optional personal PIN.

Monitoring and Reporting SecurID Token Authentications

You can get real-time notifications of a variety of network events, including enrollment for ID tokens.

PhoneFactor adds a second factor of authentication to your corporate login. Instead of the user entering a passcode from an ID Token, your PhoneFactor server calls the user’s phone with a passcode and instructions for secure authentication. Imprivata supports second-factor authentication with PhoneFactor.

The RSA Authentication Manager cannot communicate with the Imprivata appliance until the RSA Authentication Manager has been configured to recognize it. In the RSA Authentication Manager system, appliances must be deployed as Agent Hosts.

To configure the Imprivata appliance as an agent host:

1. Open the RSA Authentication Manager Admin UI (Start >Programs > RSA Security > RSA Authentication Manager Host Mode).

2. From Agent Host, select Add Agent Host.

3. In the Add Agent Host screen, enter the host name and network address of the Imprivata appliance.

4. Use the Group Activations or User Activations buttons to activate any groups or users who will be using Imprivata OneSign.

5. From RADIUS, select Manage RADIUS Server.

6. Expand RSA RADIUS Server Administration menu and select RADIUS Clients.

7. Click Add. The Add RADIUS dialog opens.

8. Enter the name, description, and IP address of the Imprivata appliance.

9. Enter a shared secret encryption key. You will use the key in step 4 of Configuring the Imprivata Appliance to Recognize the ID Token Server.

10. Repeat Step 1 through Step 9 to configure all other appliances as agent hosts for the RSA Authentication Manager. Use the same value for the encryption key.

NOTE: Refer to your RSA Authentication Manager documentation for additional information about the RSA Authentication Manager system.

The PhoneFactor agent cannot communicate with the Imprivata appliance until the PhoneFactor agent has been configured to recognize it. In the PhoneFactor agent, your Imprivata appliances must be deployed as RADIUS clients.

To configure the Imprivata appliance as a PhoneFactor RADIUS client:

1. Open PhoneFactor agent (Start > Programs > PhoneFactor > PhoneFactor Agent).

2. From RADIUS Authentication, make sure Enable RADIUSauthentication is selected.

3. On the Clients tab, below the list of clients, select Add to add the Imprivata appliance as a RADIUS client.

4. In the Add RADIUS Client window, enter the IP address of the Imprivata appliance. Enter a shared secret encryption key. You will use the key in Step 4 of The PhoneFactor agent cannot communicate with the Imprivata appliance until the PhoneFactor agent has been configured to recognize it. In the PhoneFactor agent, your Imprivata appliances must be deployed as RADIUS clients. .

5. (Optional) Select Require PhoneFactor user match.

6. Click OK.

7. Repeat Step 1 through Step 6 to configure all other appliances in your Imprivata enterprise as RADIUS clients. Use the same value for the shared secret.

1. Open the Configure external OTP tokens page in the Imprivata Admin Console (Devices menu > Configure external OTP tokens).

2. Enter the host name (or IP address) for the ID token server.

3. Enter the authenticationport for the ID token system RADIUS server.

NOTES:

• The most commonly used authentication ports are 1812 and 1645.
• For RSA SecurID OTP tokens, you can find the port number in the RSA Authentication Manager Configuration Management tool, under the entry for RADIUS in the Services section.

4. Enter an encryption key that you used in Configuring the External OTP Token Server to Recognize the Imprivata Appliance.

5. (PhoneFactor tokens) It takes some moments for the user to answer the phone and enter the code. Enter a value in the Additional time to wait... field to suit the needs of your users.

6. Specify whether or not the OTP token is allowed for authenticating when e-prescribing controlled substances. If you select Allowed for EPCS, then when you click Save, you are prompted to attest that the OTP token server is FIPS-compliant and that OTP tokens are properly enrolled per DEA EPCS regulations. This action is logged in the Imprivata audit records.

7. Specify how users enroll with external ID tokens:

1. (PhoneFactor tokens) Leave Enroll users automatically selected. Use the username format that matches the usernames in the PhoneFactor agent users list.

2. (RSA SecurID tokens) Select users enroll themselves. See Allowing Users to Enroll Their Own External OTP Tokens for Use with Imprivata OneSign

8. Click Save.

After the user has enrolled, the authentication process is straightforward.

To authenticate via your SecurID token:

1. Log into your computer. The Imprivata OneSignLog On window opens.
2. Click Use my OTP at the bottom of the window.
3. In the Passcode field, enter your passcode.

When you are authenticated, the authentication window closes.

To authenticate via PhoneFactor:

1. Log into your computer. The Imprivata OneSignlog on window opens.
2. Enter your username and password.
3. Click Use my OTP at the bottom of the window.
4. Click OK, and wait for your phone to ring. Within a few moments, your phone will ring with further instructions. When you are authenticated, the authentication window closes.