How to configure Keeper SSO Connect Cloud with SecureAuth for seamless and secure SAML 2.0 authentication.
Please complete the steps in the Admin Console Configuration section first.
SecureAuth can be configured using the same instructions in the Other SAML 2.0 Providers section. Please follow that guide in order to set up the SecureAuth environment.
For reference, use the SecureAuth guide located here:
A few additional important items to note regarding SecureAuth:
Ensure that "By Post" is selected in the Connection Type section:
Ensure to select "Sign SAML Assertion" and "Sign SAML Message".
Ensure the Entity ID of the IdP metadata matches the SAML response from SecureAuth.
Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.
An admin can not move themselves to the SSO enabled node. It requires another admin to perform this action.
After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.
Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.
If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.
