NATIVE SAML SUPPORT for SSO FFTH – RSA Archer 6.8
Total Page:16
File Type:pdf, Size:1020Kb
▪ Dell Customer Communication - Confidential NATIVE SAML SUPPORT FOR SSO FFTH – RSA Archer 6.8 1 ▪ Dell Customer Communication - Confidential AGENDA NATIVE SAML 2.0 SUPPORT FOR SSO ▪ Background ▪ Overview ▪ Troubleshooting ▪ Demo 2 ▪ Dell Customer Communication - Confidential BACKGROUND ▪ Main Goal: Provide native SAML 2.0 support for SSO to RSA Archer platform ▪ Prior To 6.8, RSA Archer could not process SAML 2.0 assertions natively ▪ Required using ADFS as middleware to convert SAML assertions to Windows Federated claims ▪ Increased complexity of enabling integration with SAML IDP ▪ Security concerns with ADFS served as an implementation roadblock ▪ Enabling native processing of SAML assertions eliminates the need for ADFS 3 ▪ Dell Customer Communication - Confidential OTHER GOALS ▪ Support multiple SAML identity providers for a single instance ▪ Provide vanity URLs to automatically redirect to a specific identity provider ▪ Provide Service Provider metadata for easier setup in identity provider ▪ Support automatic user provisioning ▪ Support user profile, group membership, and role assignment updates via SSO ▪ Improved logging to aid in troubleshooting authentication issues − Errors point to specific log reference in stand-alone SAML log file − Info level logging provides entire request and assertion contents ▪ Leave Federation SSO option as is 4 ▪ Dell Customer Communication - Confidential OVERVIEW 5 ▪ Dell Customer Communication - Confidential CONFIGURING SAML SSO ▪ SAML SSO is enabled by selecting the new SAML Single Sign-On Mode ▪ Allow Manual Bypass – If enabled, users can bypass SSO and log in manually with Archer credentials − For example, https://egrc.archer.rsa.com/default.aspx?manuallogin=true. ▪ Instance Entity ID – Used to identify the service provider name when issuing authentication requests 6 ▪ Dell Customer Communication - Confidential CONFIGURING SAML SSO – CERTIFICATE THUMBPRINT ▪ Certificate Thumbprint – Identifies a x.509 certificate in the Windows Local Machine Certificate Store ▪ Certificate is used to sign request when required by the Identity Provider ▪ Certificate is also used by the Identity Provider to encrypt assertions when required ▪ IIS Application Pool identity running RSA application requires read permissions to private key ▪ Same certificate must exist in Local Machine Certificate Stores of all web servers 7 ▪ Dell Customer Communication - Confidential GENERATE SERVICE PROVIDER METADATA ▪ Optionally Generate Service Provider Metadata ▪ Save Single Sign-On Settings Changes Before clicking Generate ▪ Some Identity Providers Can Import Service Provider Metadata ▪ Service Provider Metadata Is Useful Reference Regardless ▪ Service Provider Metadata XML File Includes: − Instance Entity ID − Redirection URL to RSA Archer assertion consumer service − Required Name ID preference − Public key of signing and encryption certificate − Preference for signed assertions from the IDP 8 ▪ Dell Customer Communication - Confidential CONFIGURING IDENTITY PROVIDERS ▪ SAML Mode Supports 1-To-N Identity Providers ▪ RSA Archer Platform Must Be Configured As Service Provider For Each Identity Provider ▪ Configurations Vary Per Identity Provider But Typically Require − Entity ID − Assertion Consumer Service URL − Signing Certificate − Encryption Certificate 9 ▪ Dell Customer Communication - Confidential IDENTITY PROVIDER ATTRIBUTE MAPPING ▪ RSA Attribute Mappings Must Be Configured For Each Identity Provider − These mappings are used to support creating users, updating their profile attributes, group membership, and role assignment ▪ The attributes are then set for each user 10 ▪ Dell Customer Communication - Confidential IDENTITY PROVIDER ATTRIBUTE MAPPING RSA Archer Field Name RSA Archer Supported Attribute Mapping User Identity Information User Name* NameID* User Domain UserDomain First Name FirstName Last Name LastName Middle Name MiddleName Title Title 11 ▪ Dell Customer Communication - Confidential IDENTITY PROVIDER ATTRIBUTE MAPPING RSA Archer Field Name RSA Archer Supported Attribute Mapping Contact Details Address Full Address or Street City State Zipcode Note: To update the user address, use one of the following: 1. FullAddress attribute. The Address field in the User Profile updates with the values provided in this attribute. 2. Street, City, State, Zipcode attribute. The Address field updates with the values Street, City, State and Zipcode Company Company Default Email Address EmailAddress Phone 1 PhoneNumber 12 ▪ Dell Customer Communication - Confidential IDENTITY PROVIDER ATTRIBUTE MAPPING RSA Archer Field Name RSA Archer Supported Attribute Mapping Localization Time Zone TimeZoneId See the appendix for supported TimeZoneId’s Account Maintenance Security Parameter SecurityParameterId Access Roles/Groups Groups Group/Groups Use Group for single-value attribute. Use Groups for multiple-value attributes. Roles Role/Roles Use Role for single-value attribute. Use Roles for multiple-value attributes. 13 ▪ Dell Customer Communication - Confidential EXPORT IDENTITY PROVIDER METADATA ▪ Export or download the Identity Provider metadata for Archer application ▪ This file will be used in the configuration of the Identity Provider in the RSA Archer Control Panel 14 ▪ Dell Customer Communication - Confidential ADDING IDENTITY PROVIDERS IN ACP ▪ Must Have At Least One Identity Provider ▪ Enter Display Name. − This Display Name will Be Populated In IDP Dropdown Selector − This Name Will Also Be Displayed In IDP Selector For Login Decision Page ▪ Enter Realm Name For The IDP − The Realm field value, instance URL, and parameter name IDP can be used to skip the Single Sign-On Decision Page. − e.g. https://archer.domain.com?IDP=okta skips the Decision Page and immediately redirects you to North America Okta for authentication ▪ Required Encrypted Assertions – If Enabled RSA Archer will fail authentication if IDP does not encrypt assertions ▪ Click + To Add Another Identity Provider 15 ▪ Dell Customer Communication - Confidential IMPORTING IDP METADATA ▪ To complete the Identity Provider setup you must import the Identity Provider Metadata file. − Click Select and browse to your metadata xml file − Click Open to finish the import − If the selected file is valid, the IDP Metadata field shows the IDP entity descriptor ▪ IDP metadata provides the details the Archer platform needs: − To create authentication requests − To process corresponding assertions received from IDP − Typically includes URL endpoints, supported bindings, identifiers, and certificates used for signing 16 ▪ Dell Customer Communication - Confidential USER PROVISIONING SETTINGS Set the User provisions settings for each Identity Provider ▪ Enable User Provisioning – Creates new Archer account if one does not already exist for NameID ▪ Enable User Update – Enables user profile updates such as first name, last name, address, email etc. ▪ Enable Group Update – Enables group membership updates − Currently selected groups replaced by IDP groups ▪ Enable Role Update – Enables role assignment updates − Currently selected roles replaced by IDP roles ▪ Default First Name – Used if no first name supplied by IDP ▪ Default Last Name – Used if no last name supplied by IDP ▪ Default Role – Used if no role supplied by IDP 17 ▪ Dell Customer Communication - Confidential SSO LOGIN DECISION PAGE ▪ Navigating to instance URL presents RSA Archer SSO Login Decision Page ▪ This page allows end-user to select from the list of Identity Providers configured for the instance ▪ If Allow manual bypass is enabled, the Archer Manual Login is available as a selection ▪ Clicking Login redirects the authentication request to the selected Identity Provider 18 ▪ Dell Customer Communication - Confidential SKIPPING DECISION PAGE ▪ The IDP parameter redirects the authentication request to the Identity Provider tied to the Realm value skipping decision page ▪ Assume Instance URL is set to http://sales.instance.archer.com/RSAArcher ▪ Entering http://sales.instance.archer.com/RSAArcher/default.aspx?IDP=okta as the URL would redirect the request immediately to the North America –Okta IDP as it is tied to “okta” Realm 19 ▪ DellTROUBLESHOOTING Customer Communication - Confidential ▪ Logging for issues with SAML SSO authentication is much more robust than it is with Federated mode ▪ When a SAML SSO authentication failure occurs a specific log reference is presented to the end-user ▪ Errors encountered during SAML SSO Authentication are collected in a new log file within the instance folder a name format of {ServerName}.{Instance}.SAML.{Date_YYYYMMDD}.xml 20 ▪ Dell Customer Communication - Confidential TROUBLESHOOTING ▪ If log reference does not provide enough information. You can also enable Information level logging to provide more context ▪ Info level logging records the full SAML request message as sent and the full SAML assertion received which can greatly aid in troubleshooting 21 ▪ Dell Customer Communication - Confidential DEMO 22 ▪ Dell Customer Communication - Confidential APPENDIX – SUPPORTED TIME ZONE VALUES ▪ The table on the following slides lists all the supported time zone values that can be used to update the users time zone via SAML SSO ▪ The Time Zone value should be passed as the string in the first column. ▪ The second column shows the value as its represented in the Time Zone drop-down of Manage Users 23 ▪ Dell Customer Communication - Confidential APPENDIX – SUPPORTED TIME ZONE VALUES RSA Archer Supported Time Zone RSA Archer Drop-Down Values Dateline Standard Time (UTC-12:00)