Blackberry PRD-10459-003 Administration Guide - Page 224

Administration Guide Configuring software tokens for BlackBerry devices Configuring software tokens for BlackBerry 21 devices The BlackBerry® Enterprise Server is designed to work with the RSA® Authentication Manager to provide software token support for use with layer 2 and layer 3 Wi-Fi® authentication on Wi-Fi enabled BlackBerry devices. When you configure a software token for users, BlackBerry devices are designed to use the passcode to authenticate the users to the Wi-Fi network and VPNs automatically using the PEAPv1, EAP-GTC, and EAP-TTLS or EAP-GTC authentication methods. You can configure multiple software tokens for each user. For example, you can configure one software token that a user can use with Wi-Fi authentication and a second software token that a user can use with VPN authentication. When users try to open a Wi-Fi or VPN connection that requires two-factor authentication on the BlackBerry devices, the BlackBerry devices prompt the users to type the software token PIN and submit the current tokencode for the connection type to create the passcode for two-factor authentication. For more information about how the BlackBerry Enterprise Server supports software tokens, see the BlackBerry Enterprise Solution Security Technical Overview. Prerequisites: Configuring BlackBerry devices for RSA authentication To perform tasks in the RSA® Authentication Manager, see the RSA Authentication Manager documentation, and the documentation for the RSA SecurID® token. • In the RSA Authentication Manager, configure the following policies for the PINs of the software tokens in your organization's environment: • whether a PIN is required for authentication • whether a PIN is defined by the user or generated by the RSA Authentication Manager • whether a PIN is alphanumeric or numeric only • whether a PIN has a fixed length or a variable length, with a minimum of four characters and a maximum of eight characters • Import the token seed file (also known as the *.sdtid file) that contains the UID for each software token into the RSA Authentication Manager Database. • In the RSA Authentication Manager Database, create a user record for each software token holder. • In the RSA Authentication Manager Administration application, configure the following parameters for the software token seed file: • serial number • cryptographic algorithm • user account that you can assign the software token to • password to protect the software token seed file • Communicate the password to the user. 222