January 2025 - Cloud Authentication Service 

Cloud Authentication Service Updates

The following subsections outline the new and enhanced features of the Cloud Authentication Service (CAS).

Cloud Administration Console Notifications for Password Spray Attack Detection

In the Cloud Administration Console, on-screen notifications have been added to help administrators detect and respond more quickly to potential password spray attacks. These enhancements enable faster identification of suspicious authentication attempts, especially when the user ID does not match any known users, signaling possible malicious activity. Administrators can now more effectively assess and mitigate threats.

Secure My Page SSO Applications with Access Policy 2.0

Administrators are now required to assign only Access Policy 2.0 to My Page SSO applications, both when adding new applications and when editing existing ones. When adding a new My Page SSO application, the User Access tab will only display Access Policy 2.0 options. Additionally, when editing existing applications, administrators need to select 2.0 Access Policy for authentication, as 1.0 policies can no longer be edited.

When accessing an SSO application secured by a 2.0 access policy, users will no longer be prompted to authenticate with the My Page policy, only the 2.0 policy for that application. However, they will still need to complete the My Page policy when accessing the My Page Application Portal, launching Identity Router (IDR) SSO Portal applications, or visiting preexisting SSO applications protected by 1.0 policies.

These updates streamline access management by ensuring that all My Page SSO applications are protected by Access Policy 2.0, enhancing application security.

Note: Bookmark applications still use 1.0 policies.

Manage User Groups in the Cloud Administration Console

In the Cloud Administration Console (under Users > Groups), administrators can now create and manage Local Groups. Local Groups seamlessly integrate users from various identity sources (internal identity source, AD/LDAP, or SCIM), allowing them to be grouped together in a single group. Additionally, administrators can search for users individually and add them to groups for bulk user additions.

Enhanced My Page Applications Access Management

In the Cloud Administration Console, administrators can now assign specific access levels based on individual user attributes for application provisioning. This feature offers enhanced flexibility, customization, and more granular access management. Within the Fulfillment tab, administrators can now assign role/group permissions based on the available user attributes. The Fulfillment service provisions the application with the assigned roles/groups, ensuring that users are granted the appropriate privileges based on their needs.

Secure RSA Cloud Administration APIs Using OAuth 2.0

The RSA Cloud Administration APIs now support the OAuth 2.0 authorization framework, providing secure, token-based access to the Administration APIs. This integration enhances both security and flexibility, allowing administrators to manage access with detailed permissions. In the Cloud Administration Console, under Platform > API Key Management, administrators can now configure Administration API clients. OAuth 2.0 supports client authentication before issuing access tokens. It also allows fine-grained permission controls and configurable token validity, providing a more secure and flexible approach to managing API access.

Secure Access to Audit Logs for All Customers

With the support of OAuth 2.0 and granular permissions, all customers can now securely access all system-level audit logs, regardless of their ID Plus plan. This update enhances control for administrators, ensuring compliance requirements are met while offering secure and flexible access to audit logs.

Look and Feel Updates for the Cloud Administration Console

RSA is gradually updating the design of the Cloud Administration Console (for example, the header) as part of its ongoing effort to enhance the user experience.

Arabic Now Supported on My Page and Authentication Workflows

Users can now access RSA-protected resources with Arabic language support, including My Page, authentication workflows, email templates, and My Page Help.

Roles History Link Now Available on My Page

In the Request details pane, the Roles History link is now available on My Page, allowing requestors and approvers to track all changes made to a role during the request process.

Upgrade Seamlessly to the Latest RSA Authenticator App

Users still relying on the legacy RSA Authenticate app (no longer supported) for web-based authentication will now be presented with an on-screen notice guiding them to upgrade to the current RSA Authenticator app. This always-on notice provides users with clear instructions on how to transition to the supported app, improving security and providing them with access to more authentication methods.

RSA Authenticator 4.5.2 for iOS and Android – Coming Soon 

• Threat Detection for Android Rooted Devices: The RSA Authenticator app for Android now strengthens security by blocking usage on rooted devices, aligning with the protection available on the iOS version. With enhancements that extend beyond Google’s standard APIs, RSA is delivering a robust solution that ensures compliance, provides administrators with actionable insights, and minimizes the risk of false positives.
• RSA Authenticator App Now Supports Arabic: The RSA Authenticator app for iOS and Android is now available in Arabic, featuring full content translation and a right-to-left design for an intuitive user experience. This update ensures seamless accessibility for Arabic-speaking users, reflecting RSA’s commitment to global usability. 

Important Notice: Use of Company-Specific URLs Required

Effective March 2025, access through non-company-specific URLs will be discontinued. Administrators need to utilize their designated company-specific URLs for all access, including API interactions, Authentication Manager (AM) configurations, SCIM configurations, and redirected URLs from identity providers (IDPs). Access via any other URLs or those lacking a company subdomain will be blocked, resulting in potential loss of functionality (for example, https://access.securid.com or https://na2.access.securid.com). To ensure uninterrupted access, administrators need to promptly verify that all connectivity is routed through the appropriate company-specific URLs and update their configurations as necessary.
If a SAML third-party Identity Provider (IdP) is set up for logging into the Cloud Administration Console, it is essential to ensure that both the Sign-In URL and the Assertion Consumer Service (ACS) URL are configured to use the company-specific URLs on the IdP side. If they are not currently configured this way, please make the necessary updates. To find your company-specific Sign-In URL and ACS URL, go to My Account > Company Settings > Sessions and Authentications in the Cloud Administration Console.

RSA MFA Agent Support for macOS Sequoia 15.2

We are pleased to announce that RSA has officially qualified RSA MFA Agent 1.4.2 support for macOS Sequoia 15.2. Customers can now safely upgrade their macOS machines to Sequoia 15.2 and continue to use RSA MFA Agent 1.4.2 for secure user authentication and login.

Upcoming End of Primary Support (EOPS) Details

The following table provides details of the RSA products reaching the end of support within the next six months:
 

Third-Party Integrations from RSA Ready

The following integrations were recently completed or certified by RSA through the RSA Ready Technology Partner Program. For the complete catalog of Implementation Guides, see RSA Ready Integrations on the RSA Community.
  

New Integrations for ID Plus

• Skyhigh Security
• Skyhigh Security SWG
• Zimperium zConsole

Updated Integrations for ID Plus

• Check Point Gateway
• Fortigate VPN
• Microsoft NPS
• OneLogin
• SonicOS
• Zoho ME ADSelfService Plus

Fixed Issues

The following table lists the issues that are fixed for this release:
 

Known Issues

The following table lists the known issues in this release:
 

November 2024 - Cloud Authentication Service 

Cloud Authentication Service Updates

The following subsections outline the new and enhanced features of the Cloud Authentication Service (CAS).

Streamlined IP Address Management with Network Zones

Administrators can now create their own trusted and restricted IP lists. A network zone contains a range of IP addresses for trusted and restricted networks, strengthening security by controlling network traffic across CAS APIs, CAS Access Policies, and the Identity Router (IDR). These configurations are located on the page previously known as Trusted Networks, which has been renamed to Networks. This feature effectively helps protect against malicious activities, including password spraying.

 In the Cloud Administration Console, two pre-configured Network Zones are now available. The Access Policy Network Zones are used in access policies that define authentication conditions based on trusted networks. The IDR Network Zones consist of restricted networks that block unauthorized traffic directed to the IDR and are specifically utilized by the IDR. Additionally, administrators can now manage custom network zones for Authentication and Administration API Keys, ensuring that only trusted clients can access critical services.

RADIUS Client Code Matching Configuration

For  RADIUS clients that do not support challenge-response (required for code matching), administrators can now disable the Allow code matching option for specific customers. By default, the Allow code matching option is enabled, ensuring compatibility with clients that support push notification methods. However, for RADIUS clients that do not support challenge-response, disabling this option ensures they are limited to non-push authentication methods when Strict Code Matching is enforced.

iShield Key 2 OATH HOTP OTP Support Now Available

RSA is introducing the new RSA iShield Key Series, powered by Swissbit. Administrators can now upload RSA/Swissbit OATH OTP seeds through the Cloud Administration Console and select "RSA/Swissbit" as the manufacturer. Additionally, when a Swissbit iShield Key 2 is registered as an OATH HOTP OTP hardware authenticator in the Cloud Authentication Service, users can easily register the device via the My Page > My Authenticators section.

Strict Code Matching Enforcement in the Cloud Administration Console

Authentications may use an Authentication Agent or Authentication application that does not support Code Matching. In these cases, users could still use push notification methods even if code matching was enabled. A new setting, Strict Code Matching Enforcement, is now available to administrators. This option is disabled by default to avoid disrupting the current user authentication flow.

When the Strict Code Matching Enforcement option is enabled, users will only be able to use push notification methods if both the Authentication Agent and Authentication application used support the configured Code Matching method. If not, users will be prompted to use one of the other available authentication methods based on the configured policy.

Request Access to Applications and View Your Requests on My Page

Users can now request access to applications directly from My Page, either from the Application Catalog or from applications displayed on My Page that have not yet been provisioned.  Application requests can go through an approval process with options for no approval, manager approval, application owner approval, or both.  Once access is approved, users will be granted the necessary permissions. Additionally, users can view, track, and cancel their access requests as needed. Approvers can also view and manage pending action items directly from My Page. To enable users to request access, administrators can now activate the Fulfillment service in the Cloud Administration Console. Administrators can configure the approval process and set the fulfillment type (LDAP, SCIM, or Entra ID).

User Event Monitor Enhancements and Rate Limiting

To improve the efficiency of user event logging, rate limiting has been implemented to summarize certain user events when the activity exceeds a defined threshold. Rate limiting applies to "user not found" attempts. When the Cloud Authentication Service detects patterns where rate limiting is applied, administrators will receive an email notification alerting them to relevant events.

Important Notice: Use of Company-Specific URLs Required

Effective March 2025, access through non-company-specific URLs will be discontinued. Administrators need to utilize their designated company-specific URLs for all access, including API interactions, Authentication Manager (AM) configurations, SCIM configurations, and redirected URLs from identity providers (IDPs). Access via any other URLs or those lacking a company subdomain will be blocked, resulting in potential loss of functionality. For example, URLs such as https://access.securid.com or https://na2.access.securid.com  will no longer be valid. To ensure uninterrupted access, administrators need to promptly verify that all connectivity is routed through the appropriate company-specific URLs and update their configurations as necessary.
If a SAML third-party Identity Provider (IdP) is set up for logging into the Cloud Administration Console, it is essential to ensure that both the Sign-In URL and the Assertion Consumer Service (ACS) URL are configured to use the company-specific URLs on the IdP side. If they are not currently configured this way, please make the necessary updates. To find your company-specific Sign-In URL and ACS URL, go to My Account > Company Settings > Sessions and Authentications in the Cloud Administration Console.

IDR SLES Upgrade (12.22.0)

• AES128-SHA
• AES128-SHA256
• AES256-SHA
• AES256-SHA256

RADIUS Authentication Rate Limiting for Failed Login Attempts

Rate limiting has been implemented for RADIUS authentication to address consecutive authentication failures.  This feature helps detect and prevent certain types of potential attacks by temporarily blocking further attempts once a failure threshold is exceeded. 

Identity Router Update Schedule and Versions

The new identity router software versions are:
 

RSA MFA Agent 9.0 for Microsoft IIS and RSA MFA Agent 9.0 for Apache Web Server – Coming Soon

The new RSA MFA Agent 9.0 for Microsoft IIS and RSA MFA Agent 9.0 for Apache Web Server now deliver all the benefits of RSA MFA Agents. New features include seamless CAS support, REST API integration, and support for a variety of MFA authentication methods, such as:

• Approve
• Biometrics
•  Authenticate OTP
• QR Code
• SecurID OTP
• SMS & Voice OTP
• Emergency Access Code

In addition, the new agents support load balancing, extended failover mechanisms, enhanced reporting capabilities, and multiple language support.
UI updates and third-party library upgrades are also included.
The RSA MFA Agent 9.0 for Microsoft IIS and RSA MFA Agent 9.0 for Apache Web Server will be available for download through the RSA ID Plus Downloads page.
Note: Primary support for RSA Authentication Agent 8.0.x for Web for IIS and Apache will end in March 2026.

Upcoming End of Primary Support (EOPS) Details

The following table provides details of the RSA products reaching the end of support within the next six months:
 

Fixed Issues

The following table lists the issues that are fixed for this release:
 

October 2024 - Cloud Authentication Service

Cloud Authentication Service Updates

The following subsections outline the new and enhanced features of the Cloud Authentication Service (CAS).
 

My Page Recovery Policy Is Now Available in the Cloud Administration Console

Users can now report issues with their registered authenticators, such as damage, loss, theft, or other issues. To facilitate this, the My Page Recovery Policy is now available, allowing administrators to control who can recover access to My Page in these circumstances. Administrators can go to Access > My Page and enable the Recovery Settings under the Enrollment and Recovery tab to activate a URL that allows users to recover their accounts if their authenticator is lost, stolen, damaged, or in other circumstances.

Note: The recovery feature is available only for users with one registered Cloud Authentication Service authenticator, providing an additional layer of security for account management.
 

Important Notice: Use of Company-Specific URLs Required

Administrators need to use their designated company-specific URLs for all access, including API access and SCIM configurations. Access through URLs that are not company-specific or do not include a company subdomain will soon be blocked without redirection, leading to functionality loss. Administrators need to promptly ensure that all connectivity is through company-specific URLs and update their configurations as needed to maintain access.
If a SAML third-party Identity Provider (IdP) is configured for logging into the Cloud Administration Console, administrators need to ensure that the Sign-In URL and the Assertion Consumer Service (ACS) URL are configured with the company-specific URLs on the IdP side. If they are not, please update them as needed. To locate the company-specific Sign-In URL and ACS URL, navigate to My Account > Company Settings > Sessions and Authentications in the Cloud Administration Console.
 

RSA Authenticator 4.5 for iOS and Android – Coming Soon

RSA Authenticator 4.5 for iOS and Android is scheduled to be released this month. RSA Authenticator 4.5 for iOS and Android is now a FIDO2 certified authenticator, allowing users to register passkeys within the app and use them with any FIDO2 certified services. Like any credentials managed in the RSA Authenticator app, these passkeys cannot be backed up or restored.

Important Notes:

• For this new feature to be available to users, administrators need to enable the use of the RSA Authenticator app as a FIDO Authenticator (from Access > My Page > My Authenticators, under Configuration).
• This new feature requires devices running at least iOS 17 and Android 14. Furthermore, certain device manufacturers may not have enabled the necessary Android modules to support the passkey feature.

RSA MFA Agent for Microsoft Windows Updates

Microsoft Entra ID Support for the RSA MFA Agent

The RSA MFA Agent 2.3.4 now supports both Entra ID and Hybrid Joined machines. Version 2.3.4 also includes all of the enhancements and issue fixes from all prior versions.
 

Secondary Groups

From RSA MFA Agent 2.3.4, you can specify an optional secondary group for the “Challenge Users” group policy. You can use this policy to include groups from a separate Active Directory forest. For more information, see the RSA MFA Agent 2.3.4 for Microsoft Windows Release Notes.

Upcoming End of Primary Support (EOPS) Details

The following table provides details of the RSA products reaching the end of support within the next six months:
 

Third-Party Integrations from RSA Ready

The following integrations were recently completed or certified by RSA through the RSA Ready Technology Partner Program. For the complete catalog of Implementation Guides, see RSA Ready Integrations on the RSA Community.

New Integrations for the Cloud Authentication Service

• Atlassian Confluence
•  Automox
• AWS IAM
• Cloudflare
• Gremlin
• Idera Team Server
•  IronWiFi
• OPSWAT MetaDefender IT Access
• Qualys Enterprise TruRisk
•  Vasion
• Watchguard

New Integrations for Authentication Manager

• Canon
• Dell PowerStore

Updated Integrations for the Cloud Authentication Service

• Coralogix
• PingOne
• Salesforce Experience Cloud
• Silverfort

Fixed Issue

The following table lists the issue that is fixed for this release:
 

August 2024 - Cloud Authentication Service

Cloud Authentication Service Updates

The following sections provide information on the new and enhanced features of the Cloud Authentication Service (CAS).
   

New APIs for Password Reset and Void Password Reset Code Now Available

The Password Reset API is now available for generating reset codes for users when signing into My Page. This API generates reset codes for specified users and allows administrators to configure the validity duration. Additionally, this API can send the generated reset codes directly to the users' default email addresses.
  

Enhancements to Microsoft Entra ID Authentication Using External Authentication Method (EAM)

In the Cloud Administration Console, administrators can now configure Microsoft Entra ID Relying Party settings and manage Authentication Options and Factor Classes through the Authentication tab. Furthermore, in the Connection Profile tab, the Relying Party Issuer URL and the Entra ID Application ID fields are now automatically populated with EAM values. For instructions on how to replace these default EAM values with Custom Control values, refer to the Microsoft Entra ID Custom Controls - Relying Party Configuration Using OIDC - RSA Ready Implementation Guide.
This integration ensures users have access to the appropriate authentication methods for accessing protected resources. For more information, refer to the Microsoft Entra ID Authentication Methods (EAM) Implementation Guide .
In response to this integration, the RSA Authentication API now includes optional parameters for specifying Authentication Context Class Reference (ACR) and Authentication Methods Reference (AMR) values. These parameters can be used to filter authentication methods available to users.
Additionally, RSA now integrates with O365 Government Community Cloud (GCC) High through EAM, providing enhanced security and seamless integration for users within specialized government cloud environments.

Access Policy 2.0 Support for OpenID Connect (OIDC) Relying Parties

In this release, administrators can configure OIDC Relying Party applications to use Access Policy 2.0 through the Cloud Administration Console. For OIDC Relying Party applications where CAS manages both primary and additional authentication, administrators can now select from the available Access Policies 2.0.
  

Updated FIDO Web Authentication and Terminology

The web authentication pages are updated to align with the latest FIDO Alliance terminology and icons.
  

Important Notice: Required Use of Tenant-Specific URLs

Administrators must use their assigned URLs. Access through URLs specifying specific regions or sites will be blocked and not redirected. If an administrator has accessed the Cloud Administration Console using a non-assigned URL, a warning has been displayed in the console for the past two years.
 

Upcoming End of Primary Support (EOPS) Details

The following table provides details of the RSA products reaching the end of support within the next six months:

The new identity router software versions are:
 

Third-Party Integrations from RSA Ready

The following integrations were recently completed or certified by RSA through the RSA Ready Technology Partner Program. For the complete catalog of Implementation Guides, see RSA Ready Integrations on the RSA Community.
  

New Integrations for the Cloud Authentication Service

• Avaya
• AWS Identity Center CloudWatch
• AWS Workspaces
• Microsoft Entra ID
• PingDirectory as an Identity Source (Cloud & AuthMgr)
• PingFederate (OIDC)
• Splunk Cloud
• Trellix
• Yodeck

Updated Integrations for the Cloud Authentication Service

•  Atlassian Confluence
• Blogin
• DocuSign
• Flatter Files
• Freshworks Freshdesk
• HappyFox
• Kintone
• Microsoft M365
• Trello

Fixed Issues

The following table lists the issues that are fixed for this release:
 

July 2024 - Cloud Authentication Service

Cloud Authentication Service Updates

The following sections provide information on the new and enhanced features of the Cloud Authentication Service (CAS).
  

New Authentication Dashboard in the Cloud Administration Console

A new Authentication dashboard has been introduced in the Cloud Administration Console. It offers a daily summary contrasting successful versus failed authentications, providing security administrators with clear insights into potential issues. Administrators can view authentication counts for the past 7, 14, and 21 days, as well as the past month, with totals displayed for each period. The Authentication dashboard helps security administrators quickly identify unusual authentication activities, improving overall monitoring and management of authentication processes.
  

OAuth 2.0 Client Credentials Grant Support

The OAuth 2.0 client credentials grant flow allows applications to securely authenticate and acquire access tokens from the authorization server without user involvement. In the Cloud Administration Console, administrators can now configure OIDC/OAuth-based applications using this flow. This feature is available in limited release upon request.
  

Dutch Language Support for My Page

My Page, authentication workflows, and email templates are now localized in Dutch, improving the user experience for Dutch-speaking users.
  

Filter Identity Source Statement Attributes

In the Cloud Administration Console, administrators can now filter identity source statement attribute values for both Single Sign-on (SSO) applications and Relying Parties. They can manage Statement Attributes by adding, editing, and deleting them as necessary. Administrators can define attribute names, select identity source properties, apply operators to selected properties, and set filter values and conditions. 
  

Usage Information Dashboard Notification

In the Cloud Administration Console, on the Usage Information dashboard, if Authentication Manager is connected to the Cloud Authentication Service and is below version 8.7 SP2, the following notification will be displayed: "Upgrade to AM 8.7 SP2 or higher to display the full count of On-prem, Hybrid, and Total users."
  

Enrollment and Emergency Access Codes Guidelines

When an administrator generates an Emergency Access Code for a user, they cannot issue an Enrollment Code. Moreover, generating an Emergency Access Code will invalidate any previously issued Enrollment Code for that user.
  

Important Notice: Required Use of Tenant-Specific URLs

Administrators must use their assigned URLs. URLs identifying specific regions or sites will no longer work, and access through these URLs will be blocked, not redirected, in the future.
  

RSA Identity Router Version 12.21 Security Update

RSA Identity Router version 12.21 release includes security updates to address a vulnerability in RADIUS protocol and miscellaneous improvements. RSA recommends applying this critical update as soon as possible if it has not already been applied.

For RADIUS clients, you can enable the Message authenticator attribute field in this version. In the Cloud Administration Console, you can enable this attribute if you have already upgraded your identity router (IDR) to the latest version. For further information, see Update Identity Router Software.

Ensure that your RADIUS client software supports sending the message authenticator attribute in each RADIUS authentication request.
Note: If your IDRs have already been upgraded to version 12.21, no further updates are necessary.
 

Identity Router Update Schedule and Versions

The new identity router software versions are:
 

In the Cloud Administration Console, on the Platform > Certificates and Encryption > Encryption Settings page, a new option, "Enable Strong Elliptic Curve Key Exchange," has been added. When enabled, the identity router (IDR) will use elliptic curves with 224 bits or higher for Transport Layer Security (TLS) key exchange in all incoming and outgoing connections. Enabling this option is strongly recommended to enhance security.
          

Third-Party Integrations from RSA Ready

The following integrations were recently completed or certified by RSA through the RSA Ready Technology Partner Program. Implementation Guides will be coming soon. For the complete catalog of Implementation Guides, see RSA Ready Integrations on the RSA Community.
  

New SAML Integrations for the Cloud Authentication Service

• AWS Identity Center

• AWS Identity Center S3

• Box

• CloudBees Feature Management

• Dropbox Sign

• HashiCorp Terraform Cloud

• IBM Resilient

• Microsoft Entra ID

• Monday.com

• Oracle Cloud Infrastructure

• SentinelOne

• Sprout Social

• Tenable Vulnerability Management

• Zoho Mail
    

Updated SAML Integrations for the Cloud Authentication Service

• Asana

• Awardco

• Boomi

• ClearSlide

• Help Scout

• iMeet Central

• Insightly

• Jamf Pro

• Jobscore

• LiveChat

• LogMeIn GoToMeeting

• LogMeIn GoToTraining

• LogMeIn GoToWebinar

• New Relic

• OneLogin

• OpenVoice

• Robin

• ThousandEyes
   

Fixed Issues

The following table lists the issues that are fixed for this release:

Known Issue

The following table lists the known issue in this release:

Previous Release Notes: Cloud Access Service and Authenticators Historical Release Notes