Configure the SSO Integration on BlueCat Edge - User Guide - BlueCat Edge

BlueCat Edge User Guide
ft:locale
en-US
Product name
BlueCat Edge
Once you have configured the SAML assertion attributes on the Identity Provider (IdP), you must configure BlueCat Edge to leverage the existing IdP to authenticate users within your organization.
Note: You must be a System Administrator to configure the SSO integration.

Configuring an SSO Integration on BlueCat Edge:

  1. In the top navigation bar, click and select SSO.
  2. Click Download to retrieve the metadata information and upload it to your IdP.
    Attention: The certificate within the metadata XML file is the generic Auth0 certificate data. If you configure a custom Auth0 SAML signing certificate within the Auth0 SAML signing certificate field and attempt to download the metadata XML file from the Download button, the downloaded metadata XML file will still contain the generic Auth0 certificate data.
    If your IdP doesn't support uploading the metadata file, enter the information found within the metadata file into your IdP. If you are entering the metadata file into your IdP, the IdP might require the following service provider settings:
    • Audience—the entityId of the EntityDescriptor. For example, urn:auth0:<Tenant Name>:<Tenant ID>-SamlConnection
    • Customer URL—the field in the IdP that designates where to send the SAML assertions once it has authenticated a user. This must be configured with the Location value in the AssertionConsumerService of the metadata file. For example, https://<Edge Cloud URL>/login/callback?connection=<Tenant ID>-SamlConnection
      Note: Some IdPs refer to this field as the Assertion Consumer Service URL, Application Callback URL, or SignIn/SSO Endpoint.
    • Login URL—the login URL of the instance. For example, https://<Edge Cloud URL>/login
    Attention: If you are manually entering the information from the metadata file, ensure that all information is entered correctly as this can cause the SSO integration to fail.
  3. Return to the BlueCat Edge UI and complete the following information:
    • Enter a name and description of the SSO integration.
    • Sign In URL: Enter the SAML SSO URL that you obtained from your IdP.
    • Request Protocol Binding: The protocol used by BlueCat Edge to send the SAML authentication request to your IdP. You can select HTTP-Redirect or HTTP-POST. The default binding value is HTTP-Redirect.
    • User ID attribute: (Optional) The attribute in the SAML token that uniquely identifies a user. If this value isn't set, the user_id will be retrieved from the following in the order listed:
      • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier or nameidentifier
      • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn or upn
      • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name or name
      Note: BlueCat Edge accepts the URL or friendly name of the unique identifier.
    • Signing Certificate: Upload the IdP public key. This must be encoded in PEM or CER format.
    • Auth0 SAML signing certificate (Optional): If you are using an Auth0 SAML signing certificate, select the Auth0 certificate that you uploaded to the BlueCat secrets manager. For more information, refer to Secrets manager.
      Attention: If you are configuring a custom Auth0 SAML signing certificate, you must also upload the Auth0 SAML signing certificate to your IdP to ensure that the verification certificate on the IdP matches the certificate that is used by BlueCat Edge.
  4. Click Test to test the new connection. A new tab opens where you will be asked to sign in to your IdP to test the authentication and connection.
    Note: If you are editing an active SSO integration, click Apply & Test to test the updated connection. Clicking the Apply & Test button immediately applies all modified settings to the active SSO integration.
  5. If the SSO test is successful, click the Active toggle to activate the SSO integration. If the test was unsuccessful, you can't activate the connection. If you are editing an active SSO integration, you can toggle to deactivate the SSO integration.
    Attention: Any API access key set created before activating or deactivating the SSO integration won't be valid in the new SSO state. You must create a new API access key set in the new SSO state to continue to use the BlueCat Edge API. If you deactivate or activate the SSO integration again, you can use the API access key set that was previously created.
  6. Click Save to apply the settings.
Once you enable the SSO integration, all users must use single sign-on to log in to BlueCat Edge. However, locally-created System Administrator users can log in to BlueCat Edge using credentials that are created on the BlueCat Edge Cloud.
Attention: BlueCat strongly recommends that the corporate system administrator users create a new API access key set after enabling the SSO integration.