Quick Setup - Configuring IDP-Initiated SAML for Third-Party Application
Solution Summary
This article describes the configuration steps involved in integrating the third-party application with Cloud Access Service (CAS) using SAML 2.0.
Integration Types
My Page SSO provides Single-Sign-On (SSO) to Application name users leveraging RSA self-service portal My Page. Both SP-initiated SSO and IdP-initiated SSO are supported.
Modern Cloud-hosted SSO with My Page replaces the existing SAML SSO support with IDR.
Note: RSA will continue to maintain existing SAML SSO integrations using IDR My Applications. At a to-be-determined future date, RSA will announce the end-of-life (EOL) date for the SAML SSO support with IDR. For more information, see Available Now: My Page SSO Enhancements.
Relying Party integrations use SAML 2.0 to direct users’ web browsers to CAS for authentication. With Relying Party integration, CAS can manage either additional authentication only or both primary authentication (for example, user ID and password) and additional authentication, depending on the service provider's capability.
Supported Features
When integrated with CAS using SAML 2.0, the third-party application users can authenticate with any of the following multi-factor authentication methods.
Authentication Methods | Relying Party | My Page SSO |
|---|---|---|
| Approve | ||
| LDAP Password | ||
| SecurID OTP | ||
| Authenticate OTP | ||
| Device Biometrics | ||
| SMS OTP | ||
| Voice OTP | ||
| FIDO Security Key | ||
| QR Code | ||
| Emergency Access Code | ||
| OATH OTP |
Note: For the list of currently supported authentication methods, see Authentication Methods for Cloud Access Service Users.
Configuration Steps
This section contains instruction steps that show how to configure the third-party application with CAS using all supported integration types.
This article is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products to install the required components.
All RSA and third-party application components must be installed and working prior to the integration.
SAML My Page SSO
SAML Relying Party
SAML My Page SSO Configuration
This section describes how to configure the third-party application as a service provider for CAS.
Configure CAS
Perform these steps to configure CAS as an IdP for third-party application..
Procedure
Sign in to Cloud Administration Console and navigate to Applications > Application Catalog.
Click Create From Template and click Select for SAML Direct.
On the Basic Information page, choose Cloud and enter the name for the application.
Click Next Step.
On the Connection Profile page, choose IdP-initiated under the Initiate SAML Workflow section.
Under Data Input Method, enter the following details.
ACS URL: https://third-party application domainname/domain format/
Service Provider Entity ID: The name must match the Issuer Entity ID as confirmed in the third-party application.
Scroll down to the Identity Provider section. Make a note of the Identity Provider URL as it will be needed for the third-party application configuration.
Click Show IdP Advanced Configuration.
Retain the Identity Provider Entity ID and Audience for SAML Response as the default unless the third-party application needs them to be set differently.
In the SAML Response Protection section, do one of the following:
To sign the SAML assertion only, click the IdP signs assertion within response option.
To sign the whole SAML response, click the IdP signs entire SAML response option.
Click Generate Cert Bundle or use your own certificates. Download IdP Certificate to configure the third-party application.
If you have any SP signing certificate available, upload it in the following section.
Under the User Identity section, select the Identifier Type and Property value as needed by the third-party application. Typical Identity attributes are emailAddress and mail.
Identifier Type: emailAddress
Property: mail
Click Next Step.
In the 2.0 Access Policy for Authentication list, select your desired access policy for the application.
Click Next Step.
On the Portal Display page, select Display in Portal and click Next step.
.
Provide the Fulfillment details.
Click Publish Changes.
The SAML SSO configuration for your application is now active in CAS.
CAS configuration is complete.
Configure Third-Party Application
Refer to your application configuration guide for SAML.
SAML Relying Party Configuration
This section describes how to integrate CAS with third-party application using SAML Relying Party.
Configure CAS
Perform these steps to configure CAS.
Procedure
Sign in to Cloud Administration Console.
Click Authentication Clients > Relying Parties.
On the My Relying Parties page, click Add a Relying Party.
On the Relying Party Catalog page, click Add for Service Provider SAML.
On the Basic Information page, enter a name for the application in the Name field.
Click Next Step.
On the Authentication page, choose whether the application (Service Provider) manages primary authentication, or if RSA manages all authentication. Choose an access policy.
Click Next Step.
On the Connection Profile page, provide the following values.
ACS URL: https://third-party application domain name/domain format
Service Provider Entity ID: The name must match the Issuer Entity ID as confirmed in the third-party application.
Scroll down to the Identity Provider section. Make a note of the Identity Provider URL. It is needed for the third-party application configuration.
Under the Message Protection section, for SAML Response Protection, select IdP signs assertion with response.
Under the User Identity section, select the Identifier Type and Property value as needed by the third-party application. Typical identity attributes are email and user name.
In the Identity Provider section, Entity ID is displayed.
Click Save and Finish.
Click Publish Changes.
The SAML configuration for your application is now active in CAS.
CAS configuration is complete.
Configure Third-Party Application
Refer to your application configuration guide for SAML.
