Skip to main content

SAML

Identity as a Service includes a number of cloud applications for you to integrate with Identity as a Service for two-factor authentication. If you want to protect a cloud service that is not pre-configured with Identity as a Service, you can add it as a generic SAML service provider application (see Add a Generic SAML application in the Administrator Help).

attention

Entrust tests and validates SAML integrations with Identity as a Service. The integration guides provide instructions for configuring SAML authentication with the SAML application version tested by Entrust. Some configuration steps may differ from the documentation provided or the steps in the integration guides may not be effective (due to Entrust not having tested and validated with the version you are using). For different versions, the integration guides may still offer a standard base to help fast-track SAML authentication setup for your application, but in the event there are issues, contact support@entrust.com for assistance.

:::danger important

If you have already integrated a SAML application with Identity as a Service, you must update the signing certificate with the new signing certificate (SAML Certificate 2024). See Create SAML signing certificates for more information.

:::

Supported XML requests attributes and elements​

In addition to the standard SAML xml request attributes and elements, SAML supports the following one:

  • NameID

SAML also supports a configured request parameter, which may specify a login hint instead of using NameID.

SAML does not support the following SAML xml request attributes/elements:

  • AllowCreate
  • ForceAuthn
  • IsPassive
  • RequestedAuthnContext

SAML does not support the following feature:

  • Authentication request signature verification

Integrate SAML applications with Identity as a Service​

You can protect access to your SAML applications by integrating them with Identity as a Service. Once integrated, users can authenticate to their SAML application through Identity as a Service.

SP-initiated logout​

When configuring adding your SAML application to IDaaS and your SAML service provider supports SAML SP-initiated logout, set the Single Logout Service URL to the value supplied by your SAML service provider. Otherwise, leave it blank.

Identity as a Service performs session logout based on the Authentication Session Lifetime (see Manage General settings). The default value for this setting is 15 minutes. Set this parameter to an appropriate value according to your site security policy.

Identity as a Service also supports SP-initiated logout (SLO) from a SAML client application. In this case, the SAML application can be configured with a Single Logout URL. When a SAML request is sent, using either the HTTP-Redirect or HTTP-POST SAML binding, Identity as a Service logs out the current user session and the user is redirected to the configured Single Logout URL of the SAML client application using HTTP-POST binding. The binding used in the response is not configurable.

  • SAML SP-initiated logout is not propagated to all other SAML SPs.
  • Identity as a Service does not support IDP-initiated SAML logout.

Topics in this section​

📄️Epic Hyperdrive

Epic Hyperdrive is a web-based application for healthcare providers and administrators using the Epic system. See https://open.epic.com/Hyperdrive/Hyperdrive. This Technical Integration Guide describes how to integrate Entrust IDaaS multi-factor authentication (MFA) with EPIC Hyperdrive. Entrust Identity Epic Plug-in 2.0 uses the pluggable multi-factor authentication (MFA) option of Epic to integrate Identity as a Service MFA with Epic. Once integrated with Identity as a Service, users can use single sign-on to log in to their Epic Hyperdrive account through Identity as a Service.

📄️FortiSIEM

FortiSIEM is an advanced Security Information and Event Management (SIEM) solution that combines advanced log and traffic analysis with performance/availability monitoring, change analysis, and accurate knowledge of the infrastructure to provide accurate threat detection, remediation, incident response, and compliance reporting. See https://www.fortinet.com/products/siem. You can protect access to FortiSIEM by integrating FortiSIEM with Identity as a Service. Once integrated, users can use single sign-on to log in to their FortiSIEM account through Identity as a Service.

📄️Keeper Security

Keeper Security provides a password protection tool for your organization. Keeper Security supports SSO for Managed Services Providers (MSP) to access Managed Services Center (MSC) without the need for a separate login. An SSO login validates usernames and passwords against your corporate user database that is protected by IDaaS. See https://www.keepersecurity.com/. You can protect access to Keeper Security by integrating Keeper Security with Identity as a Service. Once integrated, users can use single sign-on to log in to their Keeper Security account through Identity as a Service.

📄️Sharefile

ShareFile is a secure content collaboration, file sharing and sync software that supports all the document-centric tasks and workflow needs of small and large businesses. The company also offers cloud-based or on-premises storage, virtual data rooms and client portals. ShareFile is owned by Citrix Systems. See https://www.sharefile.com. You can protect access to ShareFile by integrating ShareFile with Identity as a Service. Once integrated, users can use single sign-on to log in to their Freshworks account through Identity as a Service.

📄️Splunk SOAR

Splunk SOAR (On-premises) is a Security Orchestration, Automation, and Response (SOAR) system (see https://www.splunk.com/enus/form/soar-tour.html?utmcampaign=googleamerensearchbrand&utmsource=google&utmmedium=cpc&utmcontent=SOARTour&utmterm=splunk%20soar&bk=splunk%20soar&bt=660036319642&bm=p&bn=g&bg=122074808302&device=c&gclid=EAIaIQobChMI88i8iMeEgQMVyUFyCh3rQx4EAAYAiAAEgIKRPDBwE). You can protect access to Splunk SOAR by integrating Splunk SOAR with Identity as a Service. Once integrated, users can use single sign-on to log in to their Splunk SOAR account through Identity as a Service.