Configuring SAML Authentication with Azure as IdP (Enterprise Application) (4230484)

SAML authentication with Azure (App Registration) as Identity Provider (IdP) is an easy and fast solution for the SMA.

However, the regular APP registration in Azure does not allow the creation of custom mapping/renaming of claims, which may be necessary depending on the authentication structure of an organization.

If this is not a problem or it is the only option, please check How to use SAML authentication on the Kace SMA with Azure as the IdP.

If your Office license allows it, an Enterprise Application for SAML authentication can be set up, so more options in terms of claim customization are within reach.

The steps listed below will allow you to enable SAML on the Kace SMA and configure it to work with Azure as the IdP through an Enterprise Application registration.

Steps on the Kace SMA

• Enable SSL
  SSL configuration guide for KACE SMA
• Enable SAML

1. Go to Settings | SAML Settings.
2. Select “Enable SAML Service Provider”.
3. (Optional, version 11.1.263) Check the "Require SAML Login" box (If set, users will only be allowed to use SAML to access the SMA. Local logins will be denied for all users except for the primary Admin user and the KACE Support account (only when a Support Tether is active).
4. Select "IdP Does Not Support Passive Authentication".
5. (Version 11.1.263) Check the "Select Automatically Refresh IdP Metadata (monthly)" box.
6. Scroll Down to “Local Service (SP) Settings” and click on “View Metadata”.
7. Copy the link below “SP Assertion Consumer Service (url)” and “SP Entity Identifier (uri)” you will need these links on the Next steps on Azure. Make sure that all the links are "secure" shown as “https”. Add the “s” manually if the link is shown as “http”.
8. Stand by in Kace SMA and let's move to the steps in Azure.

Steps In Azure

• Create the Enterprise Application.

1. Go to Microsoft Azure Portal and log in with your account.
2. On the Azure portal, open "Azure Active Directory".
3. Select “Enterprise Applications” on the left panel.
4. Select “New application".
5. Select "Create your own application"
6. In the right expanded panel select "Integrate any other application you don't find in the gallery (Non-gallery)"
7. Set the name of the application.
8. Click "Create".

• Assign Users and Groups access to the Application

1. In the Application overview click on "Assign users and groups".
2. Click "Add user/group" and add the required user's group(s) that will be logging in to KACE SMA.
3. Click "Assign".

• Set up Single sign-on

1. Back on the Application Overview page click on "Set up single sign-on".
2. Select SAML.
3. On the "Basic SAML Configuration" section click on the "Edit" button.
4. On the “Identifier (Entity ID)” field, paste the “SP Entity Identifier (uri):” obtained from the SMA.
5. On the "Reply URL (Assertion Consumer Service URL)" field, paste the "SP Assertion Consumer Service (url)" obtained from the SMA.
6. Click Save.
7. Click "Edit" on the "User Attributes & Claims" section.
   1. The default claims are:
      
      Claim Name                                                                                              Value
      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress    user.mail
      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname       user.givenname
      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name               user.userprincipalname
      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname           user.surname
       
   2. IF a new claim is needed to be set up click on "Add new claim".
      1. Select from the "Source attribute" drop-down menu the required attribute.
      2. Example: user.displayname
      3. Set the source to Attribute.
      4. In the "Namespace" field paste 
      5. Set the "Name" field same as the source attribute "user.displayname".
      6. Click "Save".
   3. Let's add a group claim. This is useful to establish the role mapping in KACE SMA.
      1. Click "Add a group claim"
      2. Select "Which groups associated with the user should be returned in the claim?" in this case "Security groups" will be selected.
      3. Select the source attribute. In this case, "Group ID" will be selected.
      4. Click "Save".
          
8. Back to the "Set up single sign-on" main menu copy the App Federation Metadata Url. This value will be used back in the KACE SMA SAML configuration.

Back on the KACE SMA | SAML Settings

• Import the IdP metadata into KACE SMA
  1. Paste the App Federation Metadata URL obtained in the previous step.
  2. Click on "Import IdP Metadata".
     • This will generate all the info from the IdP by itself below.
  3. Click "View Metadata" to check the IdP metadata.

   

  

   

• Setting IdP Attribute Mappings

Note: Be careful in selecting the Primary Key (PK) attribute. The PK value should match the respective claim value from Azure in order to merge an existing user on the SMA, otherwise, a new user will be created. In this case, "Login" will be selected as PK.

IF the intention is to map the user's manager information, it is required that the claim format value is the same as the PK selected in KACE SMA. For example, if the PK is Login (Samaccountname) then the attribute to be sent should be the "ManagerSamaccountname". Also, the Manager value should match an existing user in KACE SMA.
For more info check Mapping SAML Manager Assertion with user's Manager field.

1. Go to “IdP Attribute Mappings” Select “Use SAML”.
2. Paste the Azure claims in the respective attribute fields in KACE SMA as shown below.
   Login = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   Name = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/displayname
   Primary Email = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

• Setting the SAML user's Role Mapping

Setting the role mapping is about creating a filter that will determine based on the results, the resulting role added to the user that authenticates. This filter can be based on a Claim value or based on a user attribute, e.g mail "contains" "@specifcdomain.com.
In this case, the role mapping filter will be set up based on the Group claim previously created in Azure, and the group names used are examples.

1. For the "Administrator" role set:
   http://schemas.microsoft.com/ws/2008/06/identity/claims/groups = Required Group Object ID (OID)>.
2. For the "User Console Only" role set:
   http://schemas.microsoft.com/ws/2008/06/identity/claims/groups = Required Group OID>.
3. Set the Default role for unmatched Users as desired. This will be based on the security policies. Keep in mind that this is the scenario in which the logging-in user attribute PK does not match the existing user in KACE SMA.

Now is time to Save the SAML configuration.

In some cases the Group Attribute name won’t target the group, but a groups.link instead. To sort this out, the instructions on the KB article SAML is not finding user in group to assign desired role (4267552) can be followed

The claims and their values can always be checked either to troubleshoot problems or to verify what claim should be used for each attribute based on the claim assertion that is being sent from the IdP.

For this purpose, the SAML Chrome Panel extension can be used. This allows access to a new section called "SAML" on developer tools. Hit (F12) to access Google Chrome developer tools.