Okta

Keeper Connection Manager SAML configuration with Okta

Okta Configuration

The first step regardless of installation method is to configure your SAML 2.0 identity provider using Okta.

(1) In Okta, go to Admin > Applications > Create App Integration and select SAML 2.0. Click Next.

Create a new app integration

(2) Give the Enterprise Application a name and upload the logo file linked below then click Next.

The image logo is here:

7KB

kcm-logo-420x120.png

image

(3) Configure the SAML Settings

The SAML configuration should match the format as seen below:

• Replace demo3.lurey.com with the URL of your Keeper Connection Manager domain.

• Ensure the full path appears, e.g. https://DOMAIN/api/ext/saml/callback

• For the Audience URI, use the path to the Login screen (remove the trailing slash). For example, https://demo3.lurey.com

SAML Settings

Scroll down to the Group Attribute Statements. To send the group attribute, set the name to "groups", and the name format to "Basic". If you would like ALL groups assigned to the user to be sent to Keeper Connection Manager, select the "Matches regex" with a value of ".*"

Click Next.

(4) In the Feedback section, make the selections as appears below.

Okta Group to Keeper Connection Manager Group mapping is through the Group Name. If the Keeper Connection Manager contains a Group that has the name corresponding to the Okta Group Name, the user will receive all Keeper connections assigned to that user group.

(5) Assign users and/or groups to the Keeper Connection Manager application, as you would normally do with any SAML connected app.

Assign Permissions to Keeper Connection Manager

(6) Download the Okta Metadata file and save to your local machine as metadata.xml

The location of the metadata file depends on your version of the Okta interface. In this example there is a link called "Identity Provider metadata" on the application page. There may also be a text box that contains the metadata which you can copy and paste into a local file on your computer.

The metadata XML file could also be linked in the Sign On tab > SAML Signing Certificate section under "Actions".

Save the resulting metadata.xml file by selecting "Save page as..." in your browser.

Save metadata.xml

The Okta side of the setup is complete. Note if you change anything, you need to re-download a new metadata.xml file.

Next: KCM Configuration

Advanced Linux Install Method

If you have installed Keeper Connection Manager using the advanced linux install method, setting up SAML can be performed following the steps below.

Installing SAML support for Guacamole

Keeper Connection Manager packages Guacamole’s SAML support within the kcm-guacamole-auth-sso-saml package:

$ sudo yum install kcm-guacamole-auth-sso-saml

Connecting Guacamole to SAML

Guacamole’s main configuration file, /etc/guacamole/guacamole.properties, must be modified to point the SAML installation:

$ sudo vi /etc/guacamole/guacamole.properties

The guacamole.properties file provided with Keeper Connection Manager is organized into sections documented with blocks of comments and example properties. The first section which must be modified is marked “SAML-1” and defines the IdP configuration. Uncomment the saml-idp-metadata-url and saml-entity-id property. You'll need to reference the IdP's metadata file and Entity ID.

##
## [SAML-1] Identity provider details
##
## The details of the identity provider (IdP) that Guacamole should use for
## authentication. These properties dictate how Guacamole should communicate
## with the IdP, including the how users should be redirected for
## authentication by the IdP.
##
## The SAML IdP will typically provide this information in advance in the form
## of an XML file. If no such XML file is provided, or if information is
## missing from that XML file, additional properties will need to be specified
## to provide that information.
##
## The key pieces of information required are:
##
##  * The URL of the SAML endpoint used by the IdP.
##  * The "entity ID" that should be used by Guacamole to identify itself with
##    the IdP.
##
## If the SAML IdP provides an XML metadata file, it is unusual for that file
## to not contain both of the above pieces of information.
##
## THIS INFORMATION IS REQUIRED if the SAML extension will be used.
##

saml-idp-metadata-url: file:///etc/guacamole/metadata.xml
saml-entity-id: https://demo3.lurey.com

The second section contains the callback URL that is used by the IdP. This is typically set to the user-facing URL of the Keeper Connection Manager service.

##
## [SAML-2] Guacamole server details
##
## The details of the Guacamole server that should be provided to the SAML IdP
## when authenticating the user. This information defines how the SAML IdP
## should send identity assertions back to the Guacamole server if their
## identity is confirmed.
##
## THIS PROPERTY IS REQUIRED if the SAML extension will be used. It is not
## otherwise possible for Guacamole to know its own public-facing URL,
## particularly in a production deployment that is expected to use SSL
## termination.
##

saml-callback-url: https://demo3.lurey.com

The 4th section contains optional parameters that can be set.

##
## [SAML-4] Request/response compression
##
## Whether compression should be used for requests sent to the SAML IdP, and
## whether compression should be requested for responses from the SAML IdP.
## By default, compression will be used for both requests and responses.
##

#saml-compress-request: true
#saml-compress-response: true

Completing installation

Guacamole will generally only load new extensions and reread guacamole.properties during the startup process. To apply the configuration changes, Guacamole must be restarted:

$ sudo systemctl restart guacamole

KCM Final Setup

Once you have activated the SAML module, there will be a new "Sign in with SAML" link on the login screen of the application as seen below:

Sign in with SAML Link

When setting up your user identities in the Settings area, if you would like a user to login with SAML / SSO, just leave the "password" field empty.

Creating New Users for SSO Login

If you would like to automatically mapping Group assignments in the identity provider to Keeper Connection Manager Groups, simply create a matching group name with the proper assignments. The name of the Group in Keeper Connection Manager needs to match this identifier exactly in order for the mapping to work.

Group Assignment