Getting Started

RSA Authentication Client 3.6

Welcome
RSA Authentication Client 3.6 supports the RSA SecurID 800
Authenticator (SecurID 800). With Authentication Client, SecurID 800
users can perform various authentication and cryptographic functions using
digital certificates. If they use additional RSA products (such as RSA
SecurID Software Token for Microsoft Windows), they can use one-time
passcodes (PINs and tokencodes) with automatic tokencode access. For
example, users can log on with their smart cards and authenticate to
protected web resources, applications, or Virtual Private Networks (VPNs)
using online or wireless access. They can also digitally sign e-mail messages
or encrypt files.
RSA Authentication Client includes RSA Smart Card Middleware. The
Middleware provides a Microsoft Minidriver based on the Microsoft Smart
Card Minidriver specification and an implementation of the Public Key
Cryptographic Standard #11 (PKCS #11) Application Programming
Interface (API). Developers can use the supported functions and
mechanisms to write applications that exchange information with smart cards.
Users can install Authentication Client to have access to the RSA Control
Center. The Control Center functions as the user interface. It includes
options that allow users to manage their smart cards. If users do not need the
Control Center, they can just install the Middleware portion of the product
by installing RSA Smart Card Middleware instead of RSA Authentication
Client. You can find both products on the RSA Authentication Client 3.6
CD.

1
 RSA Authentication Client

RSA Authentication Client also includes the following:

RSA PIN Unblock Wizard. Allows administrators to assist users who
block their smart card by exceeding the invalid PIN-entry limit. This
tool works with RSA Control Center or the Microsoft Windows PIN
Unblock options. By working with the user, an administrator can use a
challenge-response method to unblock the card. To install it, run the
MSI file.
RSA Card Conversion Utility. Allows a user to convert the data format
of a smart card to take advantage of performance enhancements
provided in this version of the Middleware. For example, users who
used their cards with RSA Smart Card Middleware 2.0.1 or earlier, RSA
Authentication Client 2.0.1 or earlier, or RSA Sign-On Manager 4.7 or
earlier must upgrade their smart card data formats to notice the
performance improvements. This tool automatically installs when you
install Middleware. Administrators can also control the card conversion
settings through Group Policy Object templates. For example, you can
change the default setting to deny the upgrade of the card data format if
you think users may need to continue to use the unsupported RSA
products. For more information, see the RSA Authentication Client 3.6
Group Policy Object Template Guide.
RSA Key Container Utility (KeyContainerUtility.exe). Allows
administrators to create containers for certificates to make them
Microsoft compatible. For example, if a user acquired a certificate using
PKCS #11, but the user did not request it from a Microsoft CA, the
certificate shows up on the smart card as “not Microsoft compatible.” To
make a certificate compatible, you can run this utility from the
command line and create (or delete) a key container for the certificate.

2
 Getting Started

Basic Requirements
Use RSA Authentication Client or RSA Smart Card Middleware with the
RSA SecurID 800 Authenticator. This authenticator functions as a USB
smart card and SecurID token. You can install Authentication Client or
Smart Card Middleware on the following operating systems:
• Windows XP, 32-bit Professional SP3 edition
• Windows XP, 64-bit, Professional SP2 edition
• Windows Vista SP2, 32-bit and 64-bit, Business and Enterprise editions
• Windows 7 SP1, 32-bit and 64-bit, Enterprise and Professional editions
• Windows 8, 32-bit and 64-bit, Enterprise and Professional editions
• Windows Server 2003 R2, 32-bit and 64-bit, Standard, and Enterprise
editions
• Windows Server 2008 SP2, 32-bit and 64-bit, Standard, Enterprise, Data
Center, and Web Server editions
• Microsoft Windows Server 2008 R2 SP1, 64-bit, Standard, Enterprise,
Data Center, and Web Server editions
• Windows Server 2012 SP2, Standard or Data Center editions

Important: If you use a Windows XP or Windows Server 2003 operating

system, you must install the Windows Base Smart Card Cryptographic
Service Provider (Base CSP) Package: x86 (KB909520) for Middleware to
function properly. To obtain the Base CSP package, go to the Microsoft
download site and install Windows Update KB909520.

You cannot upgrade from earlier versions of RSA Authentication Client,

RSA Authenticator Utility, or RSA Smart Card Middleware to RSA
Authentication Client 3.6 (or RSA Smart Card Middleware 3.6). You can
manually remove the earlier product or have Authentication Client detect it
and remove it automatically during the installation process.
You also cannot use these RSA products with Authentication Client or
Middleware:
• RSA Authentication Client 2.0.1 (or earlier)
• RSA Authenticator Utility 1.1 (or earlier)

3
 RSA Authentication Client

• RSA Smart Card Middleware 3.0.1 (or earlier)

• RSA Sign-On Manager 4.7 (or earlier)
• RSA Authentication Agent 6.0, 6.1, 6.1.2, or 6.4 for Microsoft Windows
For full details on the requirements, see the RSA Authentication Client 3.6
Installation and Administration Guide.

RSA Authentication Client Installation

The RSA Authentication Client 3.6 CD includes the setup.exe file and the
following folders:
• APIs. Contains the PKCS #11 API files.
• Documentation. Contains PDF documentation files that provide
information on how to use the product and tools and that describe how
to write programs that interact with smart cards. This folder also
includes documentation for RSA SecurID Software Token 4.1 in case
you install it. You only need to install this product if you plan to use
SecurID authentication with automatic tokencode access.
• Key Container Utility. Contains the Key Container Utility executable
(KeyContainerUtility.exe). Run this executable from the command line
to create a container for certificates that are not Microsoft compatible.
The container makes the certificates compatible. You can also run this
executable to list certificates on the smart card or delete containers. Use
the executable for your operating system (for example, the one in the
Win32 folder or the x64 folder).
• Licenses. Contains the license agreements.
• Policy Templates. Contains the RSA Authentication Client Group
Policy Object (GPO) templates. You can use the templates to change the
default logon settings or Control Center options for Authentication
Client. Or, use them to define the smart card PIN requirements or card
conversion process for Authentication Client or Middleware users.
• Readme. Contains the latest Readme document. This document lists the
latest features and any known or fixed issues.
• x64. Contains the RSA Authentication Client, RSA Smart Card
Middleware, and RSA PIN Unblock Wizard MSI installation files for
64-bit version operating systems.

4
 Getting Started

• x86. Contains the RSA Authentication Client, RSA Smart Card

Middleware, and RSA PIN Unblock Wizard MSI installation files for
32-bit version operating systems. It also contains MSI files for installing
RSA SecurID Software Token 4.1 for Microsoft Windows. (You need to
install this product separately if you want to use SecurID authentication
with automatic tokencode access and you do not install it by inserting
the Authentication Client CD or double-clicking the setup.exe file.)
This kit is also available in a .zip file that you can download from RSA
SecurCare Online (https://knowledge.rsasecurity.com).
This Getting Started document provides information on installing the
Authentication Client (or Smart Card Middleware) product by inserting the
CD or double-clicking the setup.exe file. For information on installing the
product from the MSI file, see the RSA Authentication Client 3.6 Installation
and Administration Guide.
If you install Authentication Client from the CD (or setup.exe file), you see
an option to install RSA SecurID Software Token 4.1.
RSA SecurID Software Token 4.1 for Microsoft Windows allows you to log
on to applications or Virtual Private Networks (VPNs) using SecurID
authentication (PIN and tokencode) with automatic tokencode access. For
example, if you see a prompt to enter a passcode, you only enter your
SecurID PIN. Then Software Token can access the tokencode from the
connected authenticator and insert it next to the PIN for you. (For more
information, see the RSA SecurID Software Token 4.1 Release Notes.)
To install the RSA Authentication Client 3.6 or RSA Smart Card
Middleware 3.6:
1. Insert the product CD to start the Install Wizard or double-click
setup.exe.

Note: If you insert the CD and the Install Wizard does not start,
your policy settings may not allow autorun capabilities. To start the
Install Wizard, double-click setup.exe.

2. Do one of the following:

• To install RSA Authentication Client without RSA SecurID
Software Token 4.1, click Install.

5
 RSA Authentication Client

• To install RSA Authentication Client with RSA SecurID Software

Token, select RSA SecurID Software Token 4.1 and click Install.
(If you already have an earlier version of RSA SecurID Software
Token installed, for example, RSA SecurID Token 4.0 for Windows
Desktops, selecting this option allows you to automatically
upgrade.)
3. Click Next at the product title dialog box. The RSA Smart Card
Middleware Welcome dialog box opens. Click Next.
4. Leave the default region where you purchased the software or select a
different region and click Next. Then select I accept the terms in the
license agreement. Click Next.
5. Do one of the following:
• For installing Authentication Client on Windows XP or Windows
Server 2003, select Complete to install all the components,
including the RSA GINA (logon dialog boxes), or click Custom to
select an option to manually install or remove the RSA GINA. Click
Next.
• For installing Authentication Client on Windows Vista or Windows
Server 2008 or to install Smart Card Middleware, skip to step 7.
6. Do one of the following:
• If you selected Complete, skip to step 7.
• If you selected Custom, the Custom Setup dialog box displays the
RSA GINA feature you can add or remove. Expand RSA GINA
and select This feature will be installed on local hard drive. Click
Next.
7. Click Install. When complete, click Finish.

Important: If you did not choose to to install RSA SecurID

Software Token 4.1, you completed the installation. If you chose to
install it, the Welcome dialog box for RSA SecurID Software Token
opens. Click Next and follow the remaining steps.

8. Follow the prompts to select the region where you purchased the
software and accept the license agreement. (Click Print to print the
agreement.) Click Next.

6
 Getting Started

9. Do one of the following:

• If you do not want to access web applications using the web browser
plug-in for Internet Explorer, click Typical.
• If you want to access web applications using the web browser
plug-in for Internet Explorer, click Custom. Expand Browser
Plug-ins and click Internet Explorer Plug-in or Firefox Plug-in
(depending on your browser) and select This feature will be
installed on local hard drive as shown.

Note: For a Custom installation, you can leave the default

installation directory or click Change to browse to a new directory.

10. Click Next, then click Install. When complete, click Finish.

7
 RSA Authentication Client

Product Documentation
RSA provides complete documentation for product installation, operation,
and administration. The documentation for this product includes PDF files.
You can find this information in the Documentation folder. You can also
find the Release Notes for RSA SecurID Software Token 4.1.

Next Steps
Before you use RSA Authentication Client 3.6 or RSA Smart Card
Middleware 3.6, read the RSA Authentication Client 3.6 Installation and
Administration Guide. The guide lists details on the system requirements
and describes how to deploy the software to multiple users. Also read the
Release Notes, which describes new features and workarounds for known
issues. If you also installed RSA SecurID Software Token 4.1, read the RSA
SecurID Software Token 4.1 Administrator’s Guide and the Release Notes
before you use the product.

Getting Support and Service

RSA SecurCare Online https://knowledge.rsasecurity.com

Customer Support Information www.emc.com/support/rsa/index.htm

RSA Solution Gallery https://gallery.emc.com/community/ma

rketplace/rsa?view=overview

RSA SecurCare Online offers a Knowledgebase that contains answers to

common questions and solutions to known problems. It also offers
information on new releases, important technical news, and software
downloads.
The RSA Solution Gallery provides information about third-party hardware
and software products that have been certified to work with RSA Security
products. The directory includes Implementation Guides with step-by-step
instructions and other information about interoperation of RSA Security
products with these third-party products.

8
 Getting Started

Trademarks
RSA, the RSA logo and EMC are either registered trademarks or trademarks of EMC Corporation
(“EMC”) in the United States and/or other countries. All other trademarks used herein are the property of
their respective owners.

© 2009-2012 EMC Corporation. All rights reserved.

October 2012