Documentation

Table of Contents

Support Links

SecureAuth Customer Support and Services

SecureAuth Service Status

Knowledge Base Articles

Versions Compared

Old Version 1

changes.mady.by.user Staci Endres

Saved on

compared with

New Version Current

changes.mady.by.user Staci Endres

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Panel
borderStyle
borderColor#000000
bgColorwhite
titleColorwhite
borderWidth1
titleBGColor#000000
borderWidthborderStyle1solid
titleIntroductionsolid

SecureAuth's SAML Multi-tenant Consumer feature transforms SecureAuth IdP into a Service Provider (SP) that consumes SAML assertions from one or multiple Identity Providers in a single SecureAuth IdP realm.

Administrators can configure a realm to accept multiple SAML assertions that will then be asserted by SecureAuth IdP to the designated post-authentication event, creating a more user-friendly user and administrator experience.

Panel
titleBGColor
borderColor#444443#444544
bgColorwhite
titleColorwhite
#444443borderWidth1
titletitleBGColorPrerequisites#444544
borderStylesolid
titlePrerequisites

1. Have an Identity Provider (or multiple) that can generate a SAML assertion to SecureAuth IdP

2. Obtain the Identity Provider's SAML Certificate and Issuer Value; or the Identity Provider's Metadata File to use in the configuration

Panel
borderStyle
borderColor#135570#145570
bgColorwhite
titleColorwhite
borderWidth1
titleBGColor#135570#145570
borderWidthborderStyle1solid
titleSecureAuth IdP Configuration Stepssolid
Panel
borderColor#116490#126591
bgColorwhite
titleColorwhitetitleBGColor#116490
borderWidth1
titletitleBGColorData#126591
borderStylesolid
titleData
Section
Column
width50%

Column

 

1. In the Membership Connection Settings section, select No Data Store from the Data Store dropdown

UI Text Box
typewarning

Click Save once the configurations have been completed and before leaving the Data page to avoid losing changes

Panel
borderColor#116490#126591
bgColorwhite
titleColorwhitetitleBGColor#116490
borderWidth1
titletitleBGColorWorkflow#126591
borderStylesolid
titleWorkflow
Section
Column
width50%

Column

 

2. In the SAML Consumer section, click Add Identity Provider to include an IdP

Panel
borderColor#007fb2#3e7fa0
bgColorwhite
titleColorwhite
borderWidth1
titleBGColor#007fb2#3e7fa0
borderWidthborderStyle1solid
titleAdd Identity ProviderborderStylesolid

3. Provide the Identity Provider Name, which is a friendly name that appears in the SAML Consumer section

4. Provide the SAML Issuer from the IdP's SAML certificate

5. Provide the SAML Audience, which is the base domain of the IdP

6a. Check SAML Conditions to enable SecureAuth IdP to utilize the NotBefore and NotOnOrAfter SAML conditions to create a validity period during which the SAML assertion is valid

6b. Set the IssueInstant Valid Time to the number of hours from the SAML assertion generation the SAML assertion is valid

UI Text Box
typewarning

** If enabling SAML Conditions, then the IssueInstant Valid Time is not required

7. Set the Clock Skew to make up for time differences between the IdP and SecureAuth IdP

8. Copy the contents of the certificate and paste it into the Signing Certificate field; or click Choose File and select the IdP's metadata file, which will complete the form

9. Click Add and Save

Section
Column
width50%

Column
width50%

Section
Column
width50%

Column

 

The new Identity Provider appears in the SAML Consumer section, where it can be Edited at any point

10. Repeat steps 2-9 for additional Identity Providers to be added

warning
UI Text Box
typeinfo

Clicking the arrow in the Edit button and selecting Generate SP Meta File creates a file with attribute information as well as the AssertionConsumerService Location

Generating this file provides the exact URL for reference, or format the URL as https://<SecureAuthIdPFQDN>/<SecureAuthRealm#>/AssertionConsumerService.aspx

For example: https://secureauth.company.com/secureauth5/AssertionConsumerService.aspx

UI Text Box
typenote

If previously utilizing SecureAuth IdP as a SAML Consumer, then note that the consumer endpoint has changed from /SAML20IdPInitACS.aspx to /AssertionConsumerService.aspx (see note above)

UI Text Box
typewarning

Click Save once the configurations have been completed and before leaving the Workflow page to avoid losing changes

Panel
borderColor#116490#126591
bgColorwhite
titleColorwhite
borderWidth1
titleBGColor#116490#126591
borderWidthborderStyle1solid
titlePost AuthenticationborderStylesolid
Section
Column
width50%

Column

 

11. In the Forms Auth / SSO Token section, click View and Configure Forms Auth keys / SSO token

Panel
borderColor#007fb2#3e7fa0
bgColorwhite
titleColorwhite
borderWidth1
titleBGColor#007fb2#3e7fa0
borderWidthborderStyle1solid
titleForms Authentication
borderStylesolid
Section
Column
width50%

Column
width50%

 

12. Set the Name of the FBA token to any name

Panel
borderColor#007fb2#3e7fa0
bgColorwhite
titleColorwhite
borderWidth1
titleBGColor#007fb2#3e7fa0
borderWidthborderStyle1solid
titleAuthentication Cookies
borderStylesolid
Section
Column
width50%

Column

 

13. Set the Post-Auth Cookie name to the same token name set in step 12

The FBA Token Name and the Post-Auth Cookie Name must match in realms utilizing the SAML Multi-tenant Consumer

UI Text Box
typewarning

Click Save once the configurations have been completed and before leaving the Forms Auth page to avoid losing changes