The Authentication Agent API for Java enables you to develop your own custom agents to protect required resources. For information about agents, see Authentication Agents.
API Features
The following sections describe the Authentication Agent API features:
Two-Step Authentication
To prevent an unauthorized person from capturing data from a SecurID authentication request, and using this data to authenticate to another RSA Authentication Manager, the agent sends a lock request before sending the user’s passcode.
The Authentication Manager locks the user name, which prevents it from being accepted by any other server in the realm, and waits for the corresponding passcode to be submitted. Once the user enters the correct passcode, the Authentication Manager unlocks the user name and authenticates the user. This process is called two-step authentication.
Note: Two-step authentication is different from two-factor authentication. RSA Authentication Manager 7.1 does not support two-step authentication.
Load Balancing
An agent that you link with the Authentication Agent API can communicate with multiple Authentication Managers in a realm. The API incorporates load-balancing routines to help the agent select the best Authentication Manager for communication. Load balancing occurs automatically based on data that the agent gathers dynamically at runtime and data acquired from the configuration files.
As an alternative to the automatic load-balancing process, you can also balance the load manually. In the sdopts.rec file, which resides on the agent host, specify which of the Authentication Managers each agent host must use to process requests.
For more information on load balancing, see Working with Load Balancing.
Thread Safety
All Authentication Agent API functions are thread-safe, which means you can safely call them from multithreaded applications without program failure or data corruption.
Synchronous Functions
All of the Java API functions are synchronous.