Ivanti Connect Secure SAML Single Sign-On (SSO)

In the Identity Administration portal, click Apps, then click Add Web Apps.

The Add Web Apps screen appears.

On the Search tab, enter the partial or full application name in the Search field and click the search icon.

Next to the application, click Add.

In the Add Web App screen, click Yes to confirm.

Identity Administration portal adds the application.

Click Close to exit the Application Catalog.

The application that you just added opens to the Application Settings page.

Configure the following:

(Optional) On the Application Settings page, click Enable Derived Credentials for this app on enrolled devices (opens in built-in browser) to use derived credentials on enrolled mobile devices to authenticate with this application.

On the Application Settings page, expand the Additional Options section and specify the following settings:

(Optional) On the Description page, you can change the name, description, and logo for the application. For some applications, the name cannot be modified.

The Category field specifies the default grouping for the application in the user portal. Users have the option to create a tag that overrides the default grouping in the user portal.

On the User Access page, select the role(s) that represent the users and groups that have access to the application.

When assigning an application to a role, select either Automatic Install or Optional Install:

• Select Automatic Install for applications that you want to appear automatically for users.

• If you select Optional Install, the application doesn’t automatically appear in the user portal and users have the option to add the application.

(Optional) On the Policy page, specify additional authentication controls for this application.

(Optional) In the Default Profile (used if no conditions matched) drop-down, you can select a default profile to be applied if a user does not match any of the configured conditions.

If you have no authentication rules configured and you select Not Allowed in the Default Profile dropdown, users will not be able to log in to the service.

Click Save.

If you have more than one authentication rule, you can prioritize them on the Policy page. You can also include JavaScript code to identify specific circumstances when you want to block an application or you want to require additional authentication methods. For more information, see Application access policies with JavaScript.

On the Account Mapping page, configure how the login information is mapped to the application’s user accounts.

The options are as follows:

• Use the following Directory Service field to supply the user name: Use this option if the user accounts are based on user attributes. For example, specify an Active Directory field such as mail or userPrincipalName or a similar field from the CyberArk Cloud Directory.

• Everybody shares a single user name: Use this option if you want to share access to an account but not share the user name and password. For example, some people share an application developer account.

• Use Account Mapping Script: You can customize the user account mapping here by supplying a custom JavaScript script. For example, you could use the following line as a script:

  LoginUser.Username = LoginUser.Get('mail')+'.ad';

  The above script instructs CyberArk Identity to set the login user name to the user’s mail attribute value in Active Directory and add ‘.ad’ to the end. So, if the user’s mail attribute value is Adele.Darwin@acme.com then CyberArk Identity uses Adele.Darwin@acme.com.ad. For more information about writing a script to map user accounts, see the SAML application scripting.

(Optional) On the Advanced page, you can edit the script that generates the SAML assertion, if needed. In most cases, you don’t need to edit this script. For more information, see the SAML application scripting.

(Optional) On the Changelog page, you can see recent changes that have been made to the application settings, by date, user, and the type of change that was made.

(Optional) Click Workflow to set up a request and approval work flow for this application.

See Manage application access requests for more information.

Click Save.

In your web browser, go to the Ivanti Connect Secure URL and sign in with your administrator credentials.

Navigate to Authentication >Auth. Servers on the Ivanti Connect Secure website and select SAML Server from the New drop-down menu and then click New Server.

Provide a name for the server and click 2.0 for the SAML Version.

On the Auth. Servers > SAML Server > Settings page, configure the following settings:

Click Save Changes.