Security Assertion Markup Language (SAML) is a standard for exchanging authentication requests and responses between service providers (SPs) and identity providers (IdPs). It enables SPs to give users access to applications across security domains through a single sign-on (SSO) authentication service that the IdP provides. You can configure the Tanium Server as an SP to give users access to the Tanium Console through the following types of SAML SSO authentication.
- Tanium Server 7.2.314.3181 and later integrates with Okta as an IdP and supports IdP-initiated SSO. Users initiate the workflow by signing into the Okta SSO portal using their enterprise username and password. Okta then exchanges authentication messages with the SP and, if authentication succeeds, the user can then click the application tile of the application they want to access.
- Tanium Server 7.3 and later integrates with any IdP, and supports both IdP-initiated and SP-initiated SSO. In an SP-initiated workflow, users try to access the application directly, at which point the SP redirects them to sign into the IdP first. The IdP then exchanges authentication messages with the SP and, if authentication succeeds, the user can then access the application.
The Tanium Server does not support user authorization (role-based access control) through SAML. To control the features, settings, and information that users are allowed to see and use after accessing the Tanium Console, configure user role permissions. For details, see RBAC overview.
The IdP administrator is responsible for configuring authentication through an Active Directory or LDAP server and managing user access through the IdP. For information about setting up a SAML application in Okta, refer to the Okta documentation. For information about setting up an application through any other IdP, refer to your IdP documentation.
A Tanium administrator must create the Tanium Console users if they authenticate through a domain-joined Active Directory back end (see Create a user) or configure an LDAP Sync connector to import users (see Using LDAP).
Only users assigned the Administrator reserved role can see and use the Configuration pages, including the SAML configuration page.
- Work with the IdP administrator to identify which users must access the Tanium Console through the IdP.
- Work with the IdP administrator when rolling out changes in the URLs where Tanium Console users access the IdP SSO portal (IdP-initiated SSO only).
- Go to Configuration > Authentication > SAML
and then Choose an IdP.
- In the Tanium URIs for Okta/Custom Configuration section, copy the Single sign on URL and Audience URI (SP entity ID) values and share them with the IdP administrator. The administrator needs this information to configure the IdP to support the Tanium Console application.
Before you perform the remaining steps, the IdP administrator must send you the IdP certificate that the Tanium Server will use to validate SAML messages received from the IdP service.
- (Custom IdP only) Configure the following settings in the Custom IdP Settings section. All the settings are required except where otherwise noted. These settings refer to elements, attributes, and values in the XML-based SAML response messages that the IdP sends to the Tanium Server after users attempt to authenticate.
- (SP-initiated SSO only) In the Service Provider Initiated SSO section, select Enable SP-initiated SSO and configure the following required fields.
- Save your changes. The Tanium Server SAML SP service then starts.
An important benefit of SSO is that it minimizes the number of times that users must respond to a password prompt when accessing and using applications. If you previously configured the Tanium Server to display a password prompt whenever users make a configuration change, you can change it to a Yes/Cancel prompt to simplify the user experience.
- Go to Configuration > Miscellaneous > Confirmation Prompt.
- Select Show a Yes/Cancel prompt.
- Save your changes.
If you ever need to stop the Tanium Server from functioning as a SAML SP, you can stop the SP service by removing the IdP
- Go to Configuration > Authentication > SAML.
- Set Choose an IdP to No Provider and save your changes.
Last updated: 9/24/2018 2:13 PM | Feedback