0

I'm implementing RADIUS authentication procedure on a client in a java application.

The RADIUS Server uses RSA SecurID to authenticate the users. As known RSA SecurID uses a token. When a user forgets his pin for the token, the token can be set to a special new pin mode on the server which forces the user to set a new pin on the next login attempt.

As fas as I know the communication workflow with the server would look like the following:

  1. Client: Send Access-Request Package to the Server with the usual attributes.
  2. Server: Reply with a package indicating the special new pin mode
  3. Client: Display an Interface to the user to enter a new pin. Send a package to the server containing the new pin.
  4. Server: Reply with a Package saying that the pin has been successfully set.
  5. Client: Display a confirmation message and ask the user for a new passcode which he created using the new pin on his token. I assume this is basically the same package as in step 1.
  6. Server: Reply with an Access-Accept package if OK or and Access-Reject if Not-OK

For step 2, 3, 4 and 5 I do not know how the package structure looks like and therefore cannot implement any logic on the client. Has anyone knowledge about the Server communication with a token is in new pin mode?

Cheers Simon

The tokens used look like this. To create a valid passcode you need to first type your PIN and hit the diamond key below the 7:

this
(source: comprosec.ch)

2
  • Are you talking about the RSA SecurID token product? The term "RSA" by itself usually refers to the cipher algorithm.
    – Wyzard
    Jul 31, 2012 at 12:17
  • Yes, exactly. Just edited the question.
    – Simon
    Jul 31, 2012 at 12:59

1 Answer 1

1

It turns out you need to look at the 'Reply-Message' (Type 18) attribute sent within the RADIUS packet from the server. It's very hacky, but it's the official solution since the RADIUS protocol doesn't support such states (see RFC 2865). Talk to your RSA contact, they can provide you with a test server and 2 test tokens to test your parsing code.

Here is what I have found out so far:

  • New-PIN-mode entry

Reply-Message contains "Enter a new PIN having from 4 to 6 digits:"

  • New-PIN-mode request confirmation PIN

Reply-Message contains "Please re-enter new PIN:"

  • New-PIN-mode success

Reply-Message contains "PIN Accepted"

  • Next-tokencode-mode start

Reply-Message contains "enter the new tokencode"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.