Additional login prompts are often the result of incorrect authentication settings.  For RSA SecurID two-factor authentication interoperation with a Client Access Server (CAS), the owa virtual directory must have Integrated Windows Authentication enabled and Anonymous Access disabled. 

To verify these setting on the CAS,  

1. Launch the IIS Manager (Start/Run/inetmgr).
2. Navigate to Web Sites\ Default Web Site\owa.
3. Right-click on owa and select Properties.
4. Select the Directory Security tab.
5. Under Authentication and Access control click Edit.
6. Uncheck the Enable Anonymous Access option.
7. Check the Integrated Windows Authentication option.
8. Click Apply and OK to save the changes.
9. Restart the IIS service (Start/Run/iisreset /noforce).

 If further login issues occur, we recommend contacting the RSA support team.