SafeNet Authentication Manager. Integration Guide. Using SAM as an Identity Provider for Dropbox

Transcription

1 SafeNet Authentication Manager Integration Guide

2 Document Information Product Version SafeNet Authentication Manager 8.2 Document version Revision A Release Date February 2014 Trademarks All intellectual property is protected by copyright. All trademarks and product names used or referred to are the copyright of their respective owners. No part of this document may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, chemical, photocopy, recording, or otherwise, without the prior written permission of SafeNet, Inc. Disclaimer SafeNet makes no representations or warranties with respect to the contents of this document and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Furthermore, SafeNet reserves the right to revise this publication and to make changes from time to time in the content hereof without the obligation upon SafeNet to notify any person or organization of any such revisions or changes. We have attempted to make these documents complete, accurate, and useful, but we cannot guarantee them to be perfect. When we discover errors or omissions, or they are brought to our attention, we endeavor to correct them in succeeding releases of the product. SafeNet invites constructive comments on the contents of this document. These comments, together with your personal and/or company details, should be sent to the address or below. Contact Method Mail Contact Information SafeNet, Inc Millennium Drive Belcamp, Maryland 21017, USA TechPubs@safenet-inc.com

3 Support Contacts If you encounter a problem while installing, registering or operating this product, please make sure that you have read the documentation. If you cannot resolve the issue, contact your supplier or SafeNet Customer Support. SafeNet Customer Support operates 24 hours a day, 7 days a week. Your level of access to this service is governed by the support plan arrangements made between SafeNet and your organization. Please consult this support plan for further information about your entitlements, including the hours when telephone support is available to you. Table 1: Support Contacts Contact Method Address Contact Information SafeNet, Inc Millennium Drive Belcamp, Maryland USA Phone United States International Support and Downloads Technical Support Customer Portal support@safenet-inc.com Provides access to the SafeNet Knowledge Base and quick downloads for various products. Existing customers with a Technical Support Customer Portal account can log in to manage incidents, get the latest software upgrades, and access the SafeNet Knowledge Base.

4

5 Contents Description... 6 Single Sign-On Dataflow... 6 Identity Provider Configuration... 7 Configuring SAM as an identity provider:... 7 Configuring Dropbox to Use SAM as an Identity Provider... 9 Configuring SAM to use SAML-based User Federation Running the Solution Logging on to Dropbox

6 Description This document provides guidance for setting up and managing SafeNet Authentication Manager (SAM) 8.2 as an identity provider for Dropbox. NOTE: The document assumes that Dropbox is already configured and working with local users and static passwords prior to implementing SafeNet Authentication Manager strong authentication. Single Sign-On Dataflow 1. Bob, a user, wants to log in to Dropbox. Bob leverages the single sign-on capabilities embedded in the organization s SafeNet Authentication Manager (SAM) solution. SafeNet Authentication Service collects Bob's credentials and evaluates Bob`s credentials. 2. SafeNet Authentication Manager s external portal collects Bob's credentials and passes them to SafeNet Authentication Manager for authentication. SAM evaluates Bob s credentials, and returns an accept or reject response to the external portal. 3. The portal uses SAM s response to return an accept or error assertion to Dropbox. 6

7 Identity Provider Configuration The SAM Configuration Manager and TPO settings are used to establish SafeNet Authentication Manager (SAM) as the identity provider for Dropbox. Configuring SAM as an identity provider: 1. From the Windows Start menu, select SafeNet Authentication Manager > Configuration Manager. The Configuration Manager window opens. 2. From the menu bar, select Action > Cloud Configuration. The Cloud Settings window opens 3. Select the Info for Service Provider tab. 4. In the Domain URL field, enter the domain URL of your organization s SAM external portal. 7

8 The Single Sign-On fields are automatically filled. 5. Do not close the Cloud Settings window. The displayed values will be needed in step 4a of Configuring Dropbox to Use SAM as an Identity Provider, on page Click Export Certificate, and save the certificate file. This file will be needed in step 4b of Configuring Dropbox to Use SAM as an Identity Provider, on page 8. NOTE: The exported certificate is in.cer format but Dropbox needs it to be converted to.pem or.crt (may be done online by 8

9 Configuring Dropbox to Use SAM as an Identity Provider To configure Dropbox to use SAM as an identity provider: 1. Log in to Dropbox. 2. On the toolbar, click Admin Console. 3. The Admin Console window opens. Click on Authentication to configure the SSO (Single Sign On). 9

10 4. Check the Enable Single Sign-On check box, and choose Optional. a. Under Sign in URL paste the Sign-in page URL copied from SAM`s Cloud Settings window. b. Click on the X.509 certificate button and upload the Identity Provider Certificate exported by the SAM Configuration Manager. 5. Click Save changes. SafeNet Authentication Manager is now configured as an identity provider for Dropbox. 10

11 Configuring SAM to use SAML-based User Federation SafeNet Authentication Manager s Token Policy Object (TPO) policies include Application Authentication Settings for SAML service providers. These settings are used by SAM s external portal to communicate with service providers. NOTE: See SafeNet Authentication Manager Version 8.2 Administrator s Guide for general portal configuration. To edit the TPO policies for SAM s portal configuration: 1. Open the Token Policy Object Editor for the appropriate group. See the SafeNet Authentication Manager Version 8.2 Administrator s Guide for more information. 2. In the left pane, select Protected Application Settings > User Authentication. The property s policies are displayed in the right pane 3. In the right pane, double-click Application Authentication Settings. 11

12 The Application Authentication Settings Properties window opens. 4. Select Define this policy setting, select Enabled, and click Definitions. The Application Authentication Settings window opens. 5. In the left pane, right-click Application Authentication Settings, and from the dropdown menu, select Create a new profile. A new profile is created. 12

13 6. In the left pane, right-click the new profile, and from the dropdown menu, select Rename. 7. Rename the profile to Dropbox. 8. In the left pane, double-click the new profile, Dropbox. The profile s policies are displayed in the right pane. 9. In the right pane, double-click the following policies, and enter the appropriate information: a. Application Issuer: Enter the Dropbox Issuer/Entity ID value Dropbox. b. Application s login URL: Enter c. User mapping: Enter the field name in your user repository that identifies your Dropbox login name. d. Enable the appropriate authentication methods for your organization. e. See the SafeNet Authentication Manager Version 8.2 Administrator s Guide for detailed information about authentication methods. 13

14 The following is an example of completed fields in the Application Authentication Settings window: 10. Click OK until all of the TPO Editor windows are closed. Dropbox is now added as a SAML service provider. 14

15 Running the Solution After Dropbox is configured to use SafeNet Authentication Manager as its identity provider, and SafeNet Authentication Manager is configured to use Dropbox as a SAML service provider, users can log in to Dropbox. NOTE: The Dropbox server and the SAS server time should be NTP synchronized; a difference in time of more than 2 second will cause a failure. Logging on to Dropbox To log in to Dropbox: 1. A user, Bob, browses to number>/, where <unique number> is a number set by Dropbox for your personal authentication link. Bob is redirected to SafeNet Authentication Manager s external portal s authentication page. 15

16 2. Bob enters his SafeNet Authentication Manager credentials, and clicks OK. He will be redirected again to Dropbox approving the authentication procedure. 16