Configuring SAML Protocol

Hideez Enterprise Server – SAML Protocol

Introduction of SAML protocol for Single Sign On

Hideez Enterprise Server supports SAML 2.0 (Security Assertion Markup Language) for secure user authentication, acting as an Identity Provider (IdP) for single sign-on (SSO) across web applications (Service Providers, SP) that support SAML 2.0. By setting up Hideez Server as an IdP, organizations can simplify login processes for users across integrated web applications.

Key Features

With Hideez Server’s support for FIDO2 passwordless authorization, service providers gain the ability to authenticate users through:

• Hardware security keys (e.g., Hideez Key, YubiKey, etc.)

• Passkeys (e.g., smartphones, laptops)

• Hideez Authenticator App

Supported Sign-in Options

• Username + password (not recommended)

• Username + password + second factor (security key: hardware or platform, OTP, mobile authenticator)

• Passwordless

  • Username + Security key (hardware or platform)

• Passwordless, User nameless (without typing login and password)

  • Security key (hardware or platform)

  • Mobile authenticator

Steps to Configure Hideez Server as an Identity Provider (IdP)

1. Set Up Hideez Server as an IdP

1. Access SAML Configuration:

• In the Hideez Server dashboard, navigate to Parameters → Settings → SAML.

2. Download or Create .pfx Certificate

• The .pfx certificate contains both the public certificate and private key. You can:

  • Download an existing certificate: Select the certificate, enter the password, and download.

• Create a new self-signed certificate: Click Create and Download, enter the password, and download.

A certificate with the .pfxextension is a file that contains both the public certificate and its private key, as well as the complete certificate chain up to the root Certificate Authority (CA). The file is usually password-protected and used for authentication, encryption, and establishing secure connections

3. Download or View IdP Components

1. Identity Provider Public Certificate (.cer): Contains only the public key and is used for server authentication and data encryption.

2. Identity Provider Metadata: Provides essential IdP details required for interaction with SPs.

Identity Provider public certificate is a certificate with the .cer (or .crt) extension is a file that contains only the public key and certificate information but does not include the private key. Its primary purpose is to authenticate the server or user and to encrypt data.

.cer files are used to secure connections, such as HTTPS for websites, client and server authentication in networks, and in various corporate applications.

Identity Provider (IdP) metadata is a file or set of data that provides essential information about your IdP to enable proper interaction with Service Providers (SP) in a SAML (Security Assertion Markup Language) context.

Some Service Providers provide users with metadata files. In this case, all required fields will be filled in automatically after importing the metadata file.

Otherwise, you can configure settings manually. In this case, the settings depend on the specific Service Provider.

2. Add Service Provider (SP)

1. Configure Settings on the Service Provider Side (SP)

• Here’s an example for Google Workspace:

  • Go to admin.google.com.
  • Navigate to Menu → Security → Authentication → SSO with third-party IdP.

  • Under Third-party SSO profiles, click Add SAML profile.

  • Enter a profile name (e.g., "Hideez Server (IdP)").

  • Paste values from Hideez Server:

    • Issuer / IdP Entity ID (e.g., https:// <your hideez server name>) (1)

    • Login URL (e.g., https:// <your hideez server name>/saml/login) (2)

    • Logout URL (e.g., https:// <your hideez server name>/saml/logout) (3)

    • Upload the Identity Provider public certificate (.cer) file (4).

    

    

    

2. Add Service Provider in Hideez Server (IdP)

• In Hideez Server, click Add Service Provider and enter the SP values:

  • Name (e.g., ⁣Google Workspace-SAML)

  • Issuer / SP Entity ID (e.g., https://accounts.google.com/samlrp/unique-id) (1)

  • ACS URL (e.g., ⁣https://accounts.google.com/samlrp/unique-id/acs) (2)

  • Click Add

  

  

  

3. Advanced Service Provider Settings

• Single Logout Service: SP endpoint for terminating sessions during logout. Obtain this URL from the SP settings.

• Name ID Format: Set based on SP requirements (Email, x509, etc.).

• Enable Request Signature Validation: Adds security by validating incoming SAML requests.

• Assertion Attributes: Configure attribute mappings to transfer necessary user details to the SP.

Some use cases for how to configure Hideez as IdP on web services:

• ASA AnyConnect VPN
• Citrix
• Fortinet
• GitHub
• GitLab
• Google Workspace
• Microsoft Exchange

List of web applications (SP) where Hideez Server can be implemented as an Identity Provider (IdP):

1. Microsoft Office 365
2. Salesforce
3. Slack
4. Dropbox business
5. Zoom
6. Atlassian (Jira, Confluence)
7. Amazon Web Services (AWS)
8. GitHub
9. GitLab
10. Zendesk
11. VMware
12. Adobe Creative Cloud
13. Box
14. Okta
15. Cisco Webex

While the list provided is not exhaustive, each web service may have its own specific configuration. If you require assistance in integrating your web app with Hideez Server using SAML, don't hesitate to contact us. We're here to help.