This section describes how to integrate RSA SecurID Access with RSA Governance and Lifecycle using a SAML SSO Agent.

Architecture Diagram

Configure RSA Cloud Authentication Service

Perform these steps to configure RSA Cloud Authentication Service as an SSO Agent SAML IdP to RSA Governance and Lifecycle. During configuration of the IdP you will need some information from the SP. This information includes (but is not limited to) Assertion Consumer Service URL and Service Provider Entity ID.

Procedure

1. Sign into RSA Cloud Administration Console and browse to Applications > Application Catalog, select RSA Governance and Lifecycle and click Add.

   

2. Enter a name for the application in the Name field on the Basic Information page and click the Next Step button.

   

3. Navigate to Initiate SAML Workflow section.

   1. In the Connection URL field, enter the url https://%HOST_NAME%/aveksa/main and replace the HOST_NAME with your RSA G&L hostname.

   

4. Scroll down to SAML Identity Provider (Issuer) section. Click Generate Cert Bundle, enter the Common Name and Generate and Download the certificate. This certificate will be required in Step 4 of Configure SAML in RSA Governance and Lifecycle section.

   

   1. Identity Provider URL - <Automatically generated>

   2. Issuer Entity ID - <Automatically generated>

   3. Select Choose File and upload the private key.

   4. Select Choose File to import the public signing certificate.

1. Scroll down to the Service Provider section.

   

   1. Assertion Consumer Service (ACS) - Enter the Assertion Consumer url as https://%HOST_NAME%/aveksa/main and replace the HOST_NAME with your RSA G&L hostname.

   2. Audience (Service Provider Entity ID) - Enter the entity id as https://%HOST_NAME%/aveksa/main and replace the HOST_NAME with your RSA G&L hostname.

2. Scroll to the User Identity section, select the following values.

   
   • Identifier Type – transient

   • Identity Source – name of your user identity source

   • Property – sAMAccountName

3. Click Next Step.

4. On the User Access page, select Allow All Authenticated Users radio button.

   

1. Click Next Step.

2. On the Portal Display page, select Display in Portal.

3. Click Save and Finish.

4. Click Publish Changes.

   

Configure SAML in RSA Governance and Lifecycle

Perform these steps to configure RSA Governance and Lifecycle as an SSO Agent SAML SP to RSA Cloud Authentication Service.

Procedure

1. Log onto your RSA Governance and Lifecycle account using administrative credentials.

2. From the navigation bar, navigate to Admin > System > Authentication. Click on Create Authentication Source.

   

3. On the Create New Authentication Service page, enter name of the your authentication source in Authentication Source Name and select SSO SAML from Authentication Type drop down. Click Next.

   

4. On the Configuration Information page, enter the following values:

   1. IdentityURL: Enter the Identity Provider URL from Step 4 of Configure RSA Cloud Authentication Service section.

   2. AveksaURL: Enter the Connection URL from Step 3 of Configure RSA Cloud Authentication Service section.

   3. IDPCertificate: Browse and select the certificate generated in Step 4 of Configure RSA Cloud Authentication Service section.

   

5. Click Finish.

Configuration is complete.

Return to the main page for more certification related information.