Swap On-Prem MFA/RSA SecurID

Depending on your security requirements, you can swap out an existing RSA SecurID configuration with one for On-Prem MFA, or vice versa.

When swapping out an RSASecurID or On-Prem MFA authenticator, you're prompted to disable the existing authenticator, if it's still enabled.

Configure replacement authenticator

  1. In the Admin Console, go to SecurityAuthenticators.
  2. In the Add Authenticator dialog, select either RSA SecurID or On-Prem MFA.

When configuring a replacement authenticator, all the configuration, except for the shared secret, is copied forward to the new authenticator.

Configure On-Prem MFA replacement

  1. Enter the following fields:
    • Provider name: This is the name that appears to end users during their login challenge.
    • Username format: Select the format expected by the provider.
    • Hostname: The server host name or IP address.
    • Authentication Port: The RADIUS server port (for example 1812). This is defined when the On-Prem RADIUS server is configured.
    • Shared Secret: An authentication key that must be defined when the RADIUS server is configured, and must be the same on both the RADIUS client and server.
  2. Click Add.
  3. Click Add New Agent. Note the value of the instance ID. You're also provided with a download link for the On-prem MFA agent installer.
  4. Activate or Deactivate the authenticator as required.
  5. Click Save.

Configure RSA SecurID replacement

  1. Enter the following fields:
    • Username format: Select the format expected by the provider.
    • Hostname: The server host name or IP address.
    • Authentication Port: The RADIUS server port (for example, 1812). This is defined when the On-Prem RADIUS server is configured.
    • Shared Secret: An authentication key that must be defined when the RADIUS server is configured, and must be the same on both the RADIUS client and server.
  2. Click Add New Agent. Note the value of the instance ID. You're also provided a download link for the agent installer.
  3. Activate or Deactivate as required.
  4. Click Save.