LastPass Business supports RSA SecurID authentication via RADIUS, enabling you to set RSA SecurID as a multifactor authentication option for your users. For this, you must first set up a RADIUS client in your RSA Authentication Manager and obtain some RSA SecurID information.

1. Add an agent host record to the RSA Authentication Manager database. Set the Agent Type to “Standard Agent” when adding the authentication agent.
   This is required to facilitate communication between LastPass Business and the RSA Authentication Manager / RSA SecurID Appliance. The agent host record identifies LastPass Business and contains information about communication and encryption.
2. Create a RADIUS client that corresponds to the agent host record in the RSA Authentication Manager. Follow the instructions to set up a RADIUS client.

   This is required because LastPass will be communicating with RSA Authentication Manager via RADIUS.

   RADIUS clients are managed using the RSA Security Console.

   The following information is required to create a RADIUS client:

   • Hostname
   • IP addresses for network interfaces
   • RADIUS Secret

   Note:  The RADIUS client’s hostname must resolve to the IP address specified.

   Since RSA Authentication Manager does not let you specify multiple IP addresses for a RADIUS client, we recommend using the "ANY Client" option, and using a separate firewall to restrict connections to the necessary IP addresses. If you use the "ANY Client" option, you also need to edit the securid.ini file and change CheckUserAllowedByClient from 1 to 0. This RADIUS client must be accessible from all LastPass server IP addresses.

3. RSA Authentication Manager administrators need to configure agent host records and/or RADIUS clients for each LastPass Business server.

   This is required because LastPass Business employs a distributed architecture which encompasses many similarly configured servers.

   There are a few different methods that can be applied with varying amounts of administrative effort. These options are:

   • Configure an agent host record and corresponding RADIUS client for each LastPass Business server.
   • Configure an agent host record for each LastPass Business server with a shared RADIUS client.
   • Configure a shared RADIUS client that does not use an agent host record (Global change).

   Note:  Refer to RSA Authentication Manager Administrators Guide for information on configuring shared RADIUS clients.
4. Copy the following values and save them to a text editor:
   • RADIUS Server IP addresses
     Note:  Separate multiple IP addresses with commas, append ':port' if not 1812 (e.g. 216.162.248.81,216.162.248.82:1645)
   • RADIUS Shared Secret
   • RADIUS Timeout (seconds)
   • Failure Message

In order to set RSA SecurID as a multifactor authentication option for your users, after having set up a RADIUS client, you are required to set up RSA SecurID integration in LastPass Business itself.

1. Log in and access the Admin Console at https://lastpass.com/company/#!/dashboard.
2. Go to Advanced > Enterprise Options > Multifactor options > RSA SecurID/RADIUS.
3. Enter the following information that you obtained in Step #1 above:
   • RADIUS Server IP addresses
     Note:  Separate multiple IP addresses with commas, append ':port' if not 1812 (e.g. 216.162.248.81,216.162.248.82:1645)
   • RADIUS Shared Secret
   • RADIUS Timeout (seconds)
   • Failure Message

   RADIUS can also be used to support other Multifactor Authentication options besides RSA Secure ID (e.g., SafeNet). If you would like to customize the name and logos that your users will see, do the following:

   • Enter a "Service Name"
   • Upload logo 1 (124x124 PNG)
   • Upload logo 2 (190x42 PNG)
4. Click Update when finished.
   

Before your users can set up RSA SecurID at their end as an added layer of security to protect their LastPass account, you need to enable RSA SecurID as a multifactor authentication option in LastPass Business.

1. From within the Admin Console, go to Advanced > Enterprise Options > Multifactor options.
2. Under Enabled Multifactor Options, toggle on the switch for the RSA SecurID/RADIUS option.

With LastPass Business, you can leave the multifactor authentication decision up to your end users, or you can mandate its use with our configurable security policies. Add a policy to require your users to use a multifactor authentication solution.

1. In the new Admin Console, go to Policies > General policies.
2. Under the Password multifactor policy category, select Require use of any MFA option. 
3. Select your desired user list for which this policy should be applied. 
4. Optional: In the Settings field, enter notes for additional information about this policy.
5. Select Enabled in the Status field.
6. Select Save changes when finished.

1. Go to https://lastpass.com/company/#!/dashboard and log in to access the Admin Console.
2. Select Users in the navigation pane.
3. Check the boxes next to your desired users.
   Tip: To sort by users enabled with RSA SecurID/RADIUS, click the Multifactor column header row for the users table.
4. Select More actions > Disable multifactor for selected users.
5. Click OK to confirm.