Secure Mobile Access 12.5 Administration Guide

Technical Documentation>  Appendix>  Configuring External SAML Identity Providers>  Configuring SAML Authentication Servers>  One Identity Cloud Access Manager>  Configuring One Identity CAM as an SMA Authentication Server
Table of Contents

Configuring One Identity CAM as an SMA Authentication Server

Configuring the One Identity Cloud Access Manager (CAM) as an SMA appliance is done by setting up a One Identity CAM Authentication Server on an SMA appliance.

To configure the One Identity CAM as an SMA Authentication Server

  1. In the AMC, navigate to System Configuration > Authentication Servers.

  2. Under Authentication servers, click the + (New) icon. The Add Authentication Server page displays.

  3. Select SAML 2.0 Identity Provider.

  4. Click Continue.... The Edit Authentication Server page displays.

    Some of the values for the fields in the Configure Authentication Server page can be obtained from the Application Created page of the One Identity Cloud Access Manager.

    The steps that follow explain how to configure the fields in the Configure Authentication Server page.

  5. In the Name field, enter CAM.

  6. In the Appliance ID field, enter the Audience/SP Identity from the Application Created page. For example, https://appliance.company.com.
  7. (Optional) Select the Sign AuthnRequest message using this certificate if you want it, and then select the appropriate certificate.
  8. In the Server ID field, enter the Issuer Entity ID or IdP from the Application Created page. For example, urn:cam.test.com.test.com/CloudAccessManager/RPSTS.

  9. In the Authentication service URL field, enter the IdP Login URL from the Application Created page. For example,

    https://sp16.test.com/CloudAccessManager/RPSTS/Saml2/Default.aspx.

  10. In the Logout service URL field, enter the SSO URL. For example, https://cam.test.com.com/CloudAccessManager/RPSTS/Saml2/Default.aspx.

  11. From the Trust the following certificate drop-down menu, select the certificate you want. This should be the certificate from the Certificate (Download Certificate) of the Application Created page.

    You must first download and install the certificate you want before it can appear in this drop-down menu. See Downloading a Certificate for instructions on how to do this.

  12. SMA supports group-based authorization through SAML authentication, allowing administrators to manage user access based on group membership even when an on-premises Active Directory is not available. In the SAML claim containing user groups field, specify the name of the SAML attribute or claim that contains the user's group membership information. For example: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

    SMA uses the values provided in this claim to determine the user's group memberships and apply the corresponding access controls.

    The SAML claim containing user groups field must be configured with the name of the SAML attribute that carries group membership information. For more information, see Group Management with SAML IdP authentication server.

  13. Enable Force users to re-authenticate to require users to enter their credentials each time they sign in to SMA. When this option is enabled, SMA requests fresh authentication from the Identity Provider and does not rely on an existing IdP session.

  14. Click Save.