Configure SAML integration

Before you begin

Make sure that you have defined a new application in your identity provider (IdP). This should consist of:

The assertion consumer service (ACS) uniform resource locator (URL) for Nozomi Networks. An ACS specifies the /auth path such as https://10.0.1.10/saml/auth
The issuer URL for your IdP, which specifies the /saml/metadata path, such as /saml/metadata. This value depends on your IdP
The metadata eXtensible Markup Language (XML) file that describes the security assertion markup language (SAML) parameters of your IdP. Before configuring your sensor, download the file from your IdP vendor and save it to a location accessible to Nozomi Networks

Note:

You can configure a mid-level Central Management Console (CMC) as IdP. For more details, see Configure identity provider. You can download the metadata from https://<address>/idp/saml/metadata, where address is the internet protocol (IP) address of the CMC that is configured as IdP.

In the top navigation bar, select
The administration page opens.
In the Settings section, select Users.
The Users management page opens.
In the top right section, select SAML.
The SAML page opens.
In the Nozomi URL field, enter the URL for your Nozomi Networks instance.
In the SAML role attribute key field, enter a string that will be used to map role names between the sensor and your IdP.

Note:
The value in this field is used to compare groups defined in the sensor with those defined in your IdP. The nature of this value depends on your IdP. (For example, if you are using Microsoft Office 365 as your IdP, the value might be http://schemas.microsoft.com/ws/2008/06/identity/claims/role

Note:
After you insert the URL in the IdP URL field, a Open metadata page hyperlink will show. This will open a new page that contains the metadata you can use in the downstream sensor. The metadata will be only be available after you save the configuration.
Select Save.
On the sensor login page, select Single Sign On.
To test the integration, use the credentials from your IdP.

Note:
For SAML to work properly, groups that match SAML roles must exist in the system. Groups are found using the role name. For example, if the SAML role attribute specifies an Operator role, the IdP looks for the Operator group when authorizing an authenticating user.

SAML has been configured, and the login page shows a new Single Sign On button.