This article describes how to integrate idGenius with RSA Cloud Access Service (CAS) using My Page SSO. The SAML application is added under Applications > Application Catalog as a SAML 2 Generic Direct SP connector, gets a tile on RSA My Page, and supports SP-initiated SAML from idGenius to RSA.

  
Configure CAS

Perform these steps to configure CAS using My Page SSO.
Procedure

1. Sign in to the RSA Cloud Administration Console as a super admin.
   
   

   Figure 1. RSA Cloud Administration Console — tenant dashboard.
       

2. Click Applications > Application Catalog.
3. Click Create From Template.
4. On the Choose Connector Template page, click SAML Direct > Select.
   The new SAML 2 Generic Direct SP application wizard appears.
   
   

   Figure 2. Choose Connector Template — pick SAML Direct. 
       

5. On the Basic Information page, enter a descriptive Name (for example, idGenius-<environment>), an optional Description, and leave the Disabled checkbox cleared.
6. Click Next Step.
   
   

   Figure 3. SAML application — Basic Information step.
      

7. On the Connection Profile page, choose SP-initiated for Initiate SAML Workflow and enter the idGenius admin host as the Connection URL. 
   
   

   Figure 4. Connection Profile — Initiate SAML Workflow and Connection URL.
       

8. Configure the Service Provider and Identity Provider sections with the following values.
   

   Field	Value/Description
   Initiate SAML Workflow	SP-initiated — idGenius starts the SAML flow when the user clicks Sign in with SSO.
   Connection URL	https://<idgenius-tenant>.idgenius.io — the idGenius admin UI host. Used by RSA admins as a portal deep-link; not invoked by RSA at runtime.
   Data Input Method	Enter Manually (Import Metadata is also supported — paste the idGenius SP metadata URL captured below to auto-populate ACS, SP Entity ID and binding).
   Service Provider — Assertion Consumer Service (ACS) URL	https://<idgenius-api-host>.idgenius.io/api/auth/saml/acs (Index 0, default). Visible in the idGenius SAML provider dialog under Service Provider Configuration → ACS URL.
   Service Provider — SP Entity ID	https://<idgenius-tenant>.idgenius.io/saml — the audience/entity identifier idGenius publishes for itself.
   Identity Provider URL	Read-only, auto-generated by RSA at save: https://<rsa-tenant>.auth.securid.com/sso/saml/<app-uuid>. Copy this value into idGenius as both IdP Entity ID and IdP SSO URL.

          
   
   

   Figure 5. Connection Profile — Service Provider and Identity Provider sections populated for the idGenius SP.
      

9. Expand the Show IdP Advanced Configuration section to view the Identity Provider Entity ID, Audience for SAML Response, and the Message Protection options. The RSA default values work for idGenius.
   
   

   Figure 6. IdP Advanced Configuration and Message Protection — RSA defaults work for idGenius.
      

   Field	Value/Description
   Identity Provider Entity ID	Default — same as Identity Provider URL (https://<rsa-tenant>.auth.securid.com/sso/saml/<app-uuid>). Identifier Type: entity.
   Audience for SAML Response	Default — same as the SP Entity ID configured before (https://<idgenius-tenant>.idgenius.io/saml).
   SAML Request Protection — SP signs SAML requests	Off. idGenius leaves AuthnRequestsSigned=false in its exported SP metadata; keep this off unless Sign AuthnRequests is enabled on the idGenius side with a paired SP certificate.
   SAML Response Protection	IdP signs assertion within response (default).
   Encrypt Assertion	Off (default). idGenius requires only signing, not encryption, of the assertion.
   Data Encryption Algorithm / Key Encryption Algorithm	AES 128/RSAOAEP (defaults — only relevant if Encrypt Assertion is enabled).

       
10. Expand the Show Connection Profile Advanced Configuration section. Confirm that User Identity > Identifier Type and Property are set to Auto Detect (RSA will issue the user's email as the SAML NameID, which is what idGenius expects), NameID Modification is set to No NameID Modification, and no Statement Attributes are added unless the deployment requires custom claims. Leave SAML Unified Logout disabled unless an SLO endpoint exists in idGenius.
    
    

    Figure 7. User Identity, NameID Modification and Statement Attributes — defaults are sufficient.
       

11. Click Next Step to advance to the User Access page. Select the Access Policy that will gate this SAML application. 
    
    

    Figure 8. User Access — bind the SAML application to an RSA 2.0 Access Policy.
       

12. Click Next Step to advance to the Portal Display page. Leave Display in Portal enabled so that idGenius appears as a tile on RSA My Page. Optionally, upload a 75×75 PNG/JPG icon, set the Application Tooltip, and confirm the Portal URL (https://<rsa-tenant>.auth.securid.com/mypage).
    
    

    Figure 9. Portal Display — My Page tile for idGenius.
      

13. Click Save and Finish. 
    
    

    Figure 10. Applications list — the new rsa-securid-saml entry visible after save.
       

14. Click Publish Changes. Pending changes are pushed to the RSA runtime; the SAML endpoint at https://<rsa-tenant>.auth.securid.com/sso/saml/<app-uuid> becomes live for SP-initiated SSO immediately afterwards.

Note: Access policies are evaluated per SAML transaction. A change to the bound policy takes effect on the next SSO transaction; in-flight browser sessions in idGenius continue under the older policy until their cookie expires.
The Identity Provider URL contains a tenant-specific application UUID. If the application is later deleted and re-created, the UUID changes — the idGenius side must be updated to match or the existing federation will silently break.

Configure idGenius

Perform these steps to configure idGenius.

Procedure

1. Sign in to idGenius as a tenant administrator at https://<idgenius-tenant>.idgenius.io. Until SAML is enabled tenant-wide, administrators authenticate with email + password + email OTP.
   
   

   Figure 11. idGenius login — the Sign in with SSO option is the entry point users will follow once the SAML provider is enabled.
       

2. In the left pane, click Settings > Administration > Authentication. In the SSO Providers pane, click the SAML Providers tab.
   
   

   Figure 12. Settings > Administration > Authentication tab.
      

3. Click Add SAML Provider to open the configuration dialog (or click the pencil icon on an existing row to edit it).
   
   

   Figure 13. SAML Providers list — Add SAML Provider opens the configuration dialog.
      

4. Populate the dialog with the values captured from the RSA side.
   
   

   Figure 14. Edit SAML Configuration — Provider identity, email domains and Identity Provider Configuration.
       

   Field	Value/Description
   Provider Name	Unique slug (lowercase, no spaces) used in URLs and audit logs — for example, rsa-securid-saml.
   Display Name	User-friendly label shown next to the Sign in with SSO button — for example, RSA SecurID SAML.
   Email Domains	Comma-separated list of email domains that should auto-discover this provider. When a user types an email in one of these domains on the idGenius login page, idGenius redirects to RSA automatically. Example: anomalix.com,idgenius.io.
   IdP Entity ID	Paste the Identity Provider URL captured from RSA: https://<rsa-tenant>.auth.securid.com/sso/saml/<app-uuid>.
   IdP SSO URL	The same value — RSA uses one endpoint for both Issuer and SingleSignOnService.
   IdP SLO URL	Leave blank unless an SLO endpoint is configured on the RSA side; idGenius will fall back to a local logout if SLO is unavailable.
   IdP Certificate (PEM)	Paste the IdP signing certificate downloaded from the RSA Message Protection section. Existing certificates are encrypted at rest and cannot be displayed; enter a new value only when rotating.
   IdP Metadata XML	Optional — if RSA's metadata XML is uploaded here, idGenius will use it as the authoritative IdP descriptor and the individual fields above are kept for human reference only.
   SP Entity ID *	https://<idgenius-tenant>.idgenius.io/saml — must match the SP Entity ID configured on the RSA application.
   ACS URL *	https://<idgenius-api-host>.idgenius.io/api/auth/saml/acs — must match the ACS URL configured on the RSA application.
   SP Metadata (read-only)	Public URL idGenius exposes for direct import into the IdP: https://<idgenius-api-host>.idgenius.io/api/auth/saml/metadata/<provider-name>. Use the copy icon to retrieve it.

             
   
   

   Figure 15. Edit SAML Configuration — Service Provider Configuration block (SP Entity ID, ACS URL, SP Metadata URL).
       

5. In the Advanced Options section, review the protocol-level details.
   
   

   Figure 16. Edit SAML Configuration — Advanced Options (SSO Binding, NameID Format, Attribute Mapping JSON).
       

   Field	Value/Description
   SSO Binding	HTTP-Redirect (default). RSA's SAML 2 Generic Direct SP endpoint supports both HTTP-Redirect and HTTP-POST; HTTP-Redirect is the recommended default.
   NameID Format	Email Address (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress). Matches the SP metadata idGenius publishes, and the User Identity > Auto Detect behavior on the RSA side.
   Attribute Mapping (JSON)	Default mapping is sufficient — idGenius reads the standard MS WS-* claim URIs for email, given name, surname and name. Customize only if the RSA application has been configured to emit additional Statement Attributes that idGenius should honour.
   Sign AuthnRequests	Off (default). Turn on only when the matching RSA option (SP signs SAML requests) has been enabled, and an SP signing certificate has been uploaded on the RSA side.

             
   Default attribute mapping payload:
   

   {
     "email":      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
     "first_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
     "last_name":  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
     "name":       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
   }
   

6. At the bottom of the dialog, enable both toggles: Enabled (turns the provider on for runtime authentication) and Auto-link accounts by email (lets a returning SAML subject bind to an existing idGenius account that shares the same primary email, without requiring the user ever to have set a local password). Click Update Configuration (or Create Configuration on a new row).
   
   

   Figure 17. Edit SAML Configuration — Enabled and Auto-link toggles, with the IdP-secret-not-shown advisory note.
      

7. Verify the provider row in the SAML Providers list shows Status = Enabled, Auto-link = On, IdP Entity ID populated, and the expected email-domain list.

Notes

• idGenius distinguishes Provider Name (the slug used in URLs and audit logs) from Display Name (the label users see in the SSO button). The slug is part of the SP Metadata URL — changing it would invalidate any external metadata bookmarks.
• Email-domain auto-discovery is independent of Auto-link. Auto-discovery decides which provider to redirect to; Auto-link decides what to do with the returned subject. Both can be on, off, or mixed.
• When the inbound user collector or a SCIM partner already creates idGenius accounts before users sign in, Auto-link should always be On — otherwise the first SAML response will fall through to the manual local-account-creation path.
• IdP certificates and SP signing keys entered in idGenius are encrypted at rest. Existing secrets cannot be retrieved or displayed afterwards — only replaced. Capture the certificate from RSA at the moment of creation and store it in the corporate vault before navigating away.
• If both a My Page SSO Application and a Relying Party exist on the same RSA tenant for idGenius, only one of them can be wired into idGenius at a time — the IdP Entity ID is unique per idGenius SAML provider row.
  To migrate from one mode to the other, edit the existing idGenius SAML provider, paste the new IdP Entity ID / SSO URL / certificate, and save. Existing user sessions remain valid; the next SP-initiated SAML transaction uses the new RSA target.
• Auto-link by email assumes the SAML NameID (email) is unique within idGenius. Duplicate email entries cause the first match to win, which may not be the intended account. Use the idGenius Record Unification rules to keep primary email values unique across HIDs. The companion SCIM integration enforces this constraint when it is the source of truth for user objects.

Verification and Sign-in Test

After both ends have been saved (Published the changes), validate the round-trip using a browser that does not currently have an idGenius session.

1. Open https://<idgenius-tenant>.idgenius.io in a private/incognito window.
2. Either type a registered email-domain address and click Continue (idGenius auto-discovers the SAML provider and redirects), or click Sign in with SSO to be shown the SAML provider chooser.
3. On the RSA-hosted IdP page, complete the primary authentication and any factor steps enforced by the bound Access Policy.
4. RSA POSTs a signed SAML response to https://<idgenius-api-host>.idgenius.io/api/auth/saml/acs.
5. idGenius validates the signature against the stored IdP certificate, reads the email NameID, auto-links to the existing local account, and lands the user on the idGenius dashboard.

Audit evidence captured by both sides

• RSA — Platform > User Event Monitor records the SSO transaction with the SP Entity ID, the authentication factors used, and the applied Access Policy.
• idGenius — Settings > Administration → Audit Log records the incoming SAML response, the auto-link decision, and the session start for the bound local user. 

Common failure modes and remediation

• "SAML validation failed" in idGenius — the IdP certificate stored in idGenius does not match the certificate RSA is actually using. Re-download from the RSA Message Protection block and re-paste.
• "Audience restriction not satisfied" — the ACS URL or SP Entity ID in RSA does not match what idGenius is sending. Both values are case- and scheme-sensitive.
• "Issuer mismatch" / silent failure — the RSA-side change was not published. Confirm the "Status: Success" banner and the Publish Changes button in the RSA console header.