I have an integration problem between RSA SecurID and Microsoft AD described in the picture below:
1.The user needs to connect to private network via VPN and authenticates to the Firewall via its username and RSA token
2.The credentials are send to the Firewall
3.The firewall is integrated with AD and resends the credentials to its local AD DC
4.The AD DC is integrated with RSA AM and when it sees that a user from the domain needs authentication it asks if the tokencode is correct
5-6-7.All steps are just replies to previous requests.
In my current state I can do the same flow but if I use user/password in the AD, otherwise said without using any RSA token authentication and RSA AM Server.
I saw the official AD FS integration with RSA guide but it doesnt seem like it is describing this case.
The idea behind is to separate the Firewall from comunicating with the RSA AM Server and if later I add other devices that authenticate with AD user they will have no need to know if the user provides local Domain password or RSA token code.
If there someone that knows how this can be done or point me to something read I'll sencerely ask him to read. Thanks in advance.