SAML authentication
This topic describes how to configure SAML authentication in PAM - Self-Hosted and in your IdP.
Overview
SAML authentication enables you to implement an Identity Provider (IdP) solution and benefit from an SSO workflow across multiple domains.
After you configure SAML authentication, all users can use this authentication method. Whether they have been provisioned using LDAP integration or were created manually as CyberArk users.
PAM - Self-Hosted supports SAML version 2.0.
Configure the IdP
|
Assertion |
PAM - Self-Hosted supports only one assertion. Make sure only one assertion is configured in your IdP. |
|
Assertion Consuming URL |
|
|
SAML Identity Location |
Make sure that your IdP specifies Identity in the NameIdentifier element of the Subject statement. The user name is located in the <Subject> statement of the assertion. |
|
Secure hash algorithm |
Use one of the following hash algorithms:
This algorithm is used to sign the responses.xml. |
|
Signed requests |
For sending signed requests configure PAM - Self-Hosted to send signed requests in the saml.config, as described in To support signed requests,. If signed requests are not configured in the saml.config, make sure the IdP is set to accept non-signed requests. |
|
User name |
Configure the IdP to return the user name inside the NameID tag. PAM - Self-Hosted supports the unspecified NameID format. |
|
The value used by the IdP to identify the PVWA as a relying party. The value must be identical to the ServiceProvider Name configures in PAM - Self-Hosted. |
|
By default, PAM - Self-Hosted supports Service Provider initiated login flow. This is the recommended and most secure flow. However, if you want to enable an IdP initiated login flow, do the following:
Supported in v10 UI only. |
Update SAML configuration after upgrading to Version 11.6 and later
If you are already working with SAML authentication, and you are upgrading to 11.6 or later, you need to update your SAML configuration settings.
- Open the saml.config file located in the installation folder (the default location is \Inetpub\wwwroot\PasswordVault), and configure the PartnerIdentityProvider Name. (The rest of the parameters are configured during the upgrade process.)
Configure SAML authentication in PAM - Self-Hosted
To configure SAML in PAM - Self-Hosted, you need to configure the PVWA and the PasswordVault web.config file.
To configure the PVWA:
-
Log on to the PVWA.
-
Click Administration > Configuration Options > Options.
-
In the Options pane, expand Authentication Methods, and click saml.
-
In the Properties pane, set the following fields:
Enabled
Set to Yes.
LogoffUrl
Specify the logoff page of your IdP.
If your IdP does not have a logoff URL, clear this field. Users will remain authenticated to the PVWA as long as they are authenticated to the IdP.
-
In the Options pane, right-click Access Restriction, and then select Add AllowedReferrer.
- In the Properties pane, in BaseURL, specify the URL of your IdP.
-
Click Apply to save the new configurations.
To edit the configuration file:
-
In the PasswordVault installation folder (the default location is \Inetpub\wwwroot\PasswordVault), make a copy of the saml.config.template file, and rename it to saml.config.
-
Edit the saml.config file as follows:
Parameter Description SingleSignOnServiceUrl The login URL of your IdP. Certificate The base 64 text representation of the certificate that is configured for your IdP as the SAML response signing certificate. This is used by the PVWA to verify the authenticity of the responses.
PartnerIdentityProvider Name
Enter the IdP identifier that enables the PVWA to identify the IdP. Also known as the EntityId of the identity provider.
ServiceProvider Name The Issuer string that enables the PVWA to identify itself to the IdP. Also known as the EntityId of the service provider.
It must be identical to the Audience defined in the IdP.
-
-
Add the following to the ServiceProvider element:
<LocalCertificates> <Certificate FileName="<local certificate path>" Password="<the password you set for the certificate>" /> </LocalCertificates> -
Add the following attribute to the PartnerIdentityProvider element:
SignAuthnRequest="true"
-
-
To support encrypted assertion:
-
Add the following within the ServiceProvider element:
<LocalCertificates> <Certificate FileName="<the exported certificate path>" Password="<the password you set for the certificate>" /> </LocalCertificates> -
Supply the certificate's public key to the IdP to encrypt the assertion.
-
-
To support force authn, add the following attribute to the PartnerIdentityProvider element:
ForceAuthn="true"
Sample SAML request and response
SAML request from the PVWA to the IdP.
|
SAML response from the IdP to the PVWA.
|
