Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

Integrated Dell Remote Access Controller 9 User's Guide

PDF

RSA SecurID 2FA

iDRAC can be configured to authenticate with a single RSA AM server at a time. The global settings on RSA AM server apply to all iDRAC local users, AD, and LDAP users.

NOTE:RSA SecurID 2FA feature is available only on Datacenter license.
Following are the pre-requisites before you configure iDRAC to enable RSA SecurID:
  • Configure Microsoft Active Directory server.
  • If you try to enable RSA SecurID on all AD users, add the AD server to the RSA AM server as an Identity Source.
  • Ensure you have a generic LDAP server.
  • For all LDAP users, the Identity Source to the LDAP server must be added in RSA AM server.

To enable RSA SecurID on iDRAC, the following attributes from the RSA AM server are required:

  1. RSA Authentication API URL — The URL syntax is: https://<rsa-am-server-hostname>:<port>/mfa/v1_1, and by default the port is 5555.
  2. RSA Client-ID — By default, the RSA client ID is the same as the RSA AM server hostname. Find the RSA client ID at RSA AM server's authentication agent configuration page.
  3. RSA Access Key — The Access Key can be retreived on RSA AM by navigating to Setup > System Settings > RSA SecurID > Authentication APIsection, which is usually displayed as l98cv5x195fdi86u43jw0q069byt0x37umlfwxc2gnp4s0xk11ve2lffum4s8302. To configure the settings through iDRAC GUI:
    • Go to iDRAC Settings > Users.
    • From Local Users section, select an existing local user and click Edit.
    • Scroll down to the bottom of the Configuration page.
    • In RSA SecurID section, Click the link RSA SecurID Configuration to view or edit these settings.
    You can also configure the settings as follows:
    • Go to iDRAC Settings > Users.
    • From Directory Services section, select Microsoft Active Service or Generic LDAP Directory Service, and click Edit.
    • In RSA SecurID section, Click the link RSA SecurID Configuration to view or edit these settings.
  4. RSA AM server certificate (chain)

You can login to iDRAC using RSA SecurID token via iDRAC GUI and SSH.

RSA SecurID Token App

You need to install RSA SecurID Token app on you system or on smart phone. When you try to log in to iDRAC, you are asked to input the passcode shown in the app.

If a wrong passcode is entered, the RSA AM server challenges the user to provide the "Next Token." This may happen even though the user may have entered the correct passcode. This entry proves that the user owns the right Token that generates the right passcode.

You get the Next Token from RSA SecurID Token app by clicking on Options. Check Next Token, and the next passcode is available. Time is critical in this step. Otherwise, iDRAC may fail the verification of the next token. If the iDRAC user login session times out, it requires another attempt to log in

If a wrong passcode is entered, the RSA AM server will challenge the user to provide the "Next Token." This challenge happens even though the user may have later entered the correct passcode. This entry proves that the user owns the right Token that generates the right passcodes.

To get the next token from RSA SecurID Token app, click on Options and check Next Token. A new token is generated. Time is critical in this step. Otherwise, iDRAC may fail the verification of the next token. If the iDRAC user login session times out, it requires another attempt to log in.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\