Skip to main content

Preconfigured SAML applications

Identity as a Service includes a number of cloud applications for you to integrate with Identity as a Service for two-factor authentication. If you want to protect a cloud service that is not preconfigured with Identity as a Service, you can add a generic SAML application.

attention

Entrust tests and validates SAML integrations with Identity as a Service. These pages provide instructions for configuring SAML authentication with the application versions tested by Entrust. Configuration steps can differ for other versions. You can use these instructions as a starting point, but contact support@entrust.com if you encounter issues.

important

If you have already integrated a SAML application with Identity as a Service, you must update the signing certificate with the new signing certificate (SAML Certificate 2024). See Create SAML signing certificates for more information.

SAML XML request attributes and elements​

IDaaS supports a configured request parameter, which can specify a login hint instead of using NameID.

IDaaS supports the following SAML XML request attributes and elements:

  • NameID
  • ForceAuthn
  • RequestedAuthnContext class references

IDaaS does not support the following SAML XML request attributes and elements:

  • AllowCreate
  • IsPassive
  • RequestedAuthnContext comparison semantics

IDaaS does not support the following feature:

  • Authentication request signature verification

Integrate SAML applications with Identity as a Service​

You can protect access to your SAML applications by integrating them with Identity as a Service. Once integrated, users can authenticate to their SAML application through Identity as a Service.

SP-initiated logout​

When configuring adding your SAML application to IDaaS and your SAML service provider supports SAML SP-initiated logout, set the Single Logout Service URL to the value supplied by your SAML service provider. Otherwise, leave it blank.

Identity as a Service performs session logout based on the Authentication Session Lifetime (see Manage General settings). The default value for this setting is 15 minutes. Set this parameter to an appropriate value according to your site security policy.

Identity as a Service also supports SP-initiated logout (SLO) from a SAML client application. In this case, the SAML application can be configured with a Single Logout URL. When a SAML request is sent, using either the HTTP-Redirect or HTTP-POST SAML binding, Identity as a Service logs out the current user session and the user is redirected to the configured Single Logout URL of the SAML client application using HTTP-POST binding. The binding used in the response is not configurable.

  • SAML SP-initiated logout is not propagated to all other SAML SPs.
  • Identity as a Service does not support IDP-initiated SAML logout.

Topics in this section​

📄️Epic Hyperdrive

Epic Hyperdrive is a web-based application for healthcare providers and administrators using the Epic system. See https://open.epic.com/Hyperdrive/Hyperdrive. This procedure describes how to integrate Entrust IDaaS multi-factor authentication (MFA) with EPIC Hyperdrive. Entrust Identity Epic Plug-in 2.0 uses the pluggable multi-factor authentication (MFA) option of Epic to integrate Identity as a Service MFA with Epic. Once integrated with Identity as a Service, users can use single sign-on to log in to their Epic Hyperdrive account through Identity as a Service.

📄️FortiSIEM

FortiSIEM is an advanced Security Information and Event Management (SIEM) solution that combines advanced log and traffic analysis with performance/availability monitoring, change analysis, and accurate knowledge of the infrastructure to provide accurate threat detection, remediation, incident response, and compliance reporting. See https://www.fortinet.com/products/siem. You can protect access to FortiSIEM by integrating FortiSIEM with Identity as a Service. Once integrated, users can use single sign-on to log in to their FortiSIEM account through Identity as a Service.

📄️Keeper Security

Keeper Security provides a password protection tool for your organization. Keeper Security supports SSO for Managed Services Providers (MSP) to access Managed Services Center (MSC) without the need for a separate login. An SSO login validates usernames and passwords against your corporate user database that is protected by IDaaS. See https://www.keepersecurity.com/. You can protect access to Keeper Security by integrating Keeper Security with Identity as a Service. Once integrated, users can use single sign-on to log in to their Keeper Security account through Identity as a Service.

📄️ShareFile

ShareFile is a secure content collaboration, file sharing and sync software that supports all the document-centric tasks and workflow needs of small and large businesses. The company also offers cloud-based or on-premises storage, virtual data rooms and client portals. ShareFile is owned by Citrix Systems. See https://www.sharefile.com. You can protect access to ShareFile by integrating ShareFile with Identity as a Service. Once integrated, users can use single sign-on to log in to their Freshworks account through Identity as a Service.

📄️Splunk SOAR

Splunk SOAR (On-premises) is a Security Orchestration, Automation, and Response (SOAR) system (see https://www.splunk.com/enus/form/soar-tour.html?utmcampaign=googleamerensearchbrand&utmsource=google&utmmedium=cpc&utmcontent=SOARTour&utmterm=splunk%20soar&bk=splunk%20soar&bt=660036319642&bm=p&bn=g&bg=122074808302&device=c&gclid=EAIaIQobChMI88i8iMeEgQMVyUFyCh3rQx4EAAYAiAAEgIKRPDBwE). You can protect access to Splunk SOAR by integrating Splunk SOAR with Identity as a Service. Once integrated, users can use single sign-on to log in to their Splunk SOAR account through Identity as a Service.