RSA SecurID Access SAML Configuration for Microsoft Office 365

Size: px

Start display at page:

Download "RSA SecurID Access SAML Configuration for Microsoft Office 365"

Patricia Baldwin
6 years ago
Views:

1 RSA SecurID Access SAML Configuration for Microsoft Office 365 Last Modified: May 8, 2017 RSA SecurID Access offers two methods to integrate with Microsoft Office 365. Both solutions integrate with your organization s Microsoft Azure AD to provide your users with a more consistent sign-in experience. Configuring either the Microsoft Office 365 or Microsoft Office 365 STS connectors provide for single sign-on (SSO) enabled users to use their Active Directory corporate credentials to access their services in the cloud and their existing on-premises resources. For guidelines to help determine which connector to use for the Office 365 applications in your deployment, see the topic Microsoft Office RSA SecurID Access Application Connector Overview on RSA Link. Complete the following procedure to configure the Microsoft Office 365 connector. Before You Begin Acquire an administrator account to both RSA SecurID Access and Office 365 Enterprise account. DNS information to register a domain with your DNS provider. Install Windows Azure Active Directory Module for Windows Powershell which requires Online Service Sign-In Assistant. Install Microsoft Directory Sync tool. Note: Refer to Microsoft s guidelines for firewall requirements Note: For instructions on Office 365 ADAL Basic Rich Client refer to Exchange Online: Enable your tenant for Modern Authentication (ADAL) 1. Use PowerShell to enable your Exchange Online service for modern authentication as described here and Skype for Business Online as described here. SharePoint Online is already enabled. 2. Enable any Office 2013 users to use modern authentication as described here. Procedure 1. Add the Application in RSA SecurID Access 2. Configure Office 365 to Use RSA SecurID Access as an Identity Provider 1 Copyright 2016 EMC Corporation. All Rights Reserved.

2 Add the Application in RSA SecurID Access Procedure 1. In the RSA SecurID Access Administration Console, click Applications > Application Catalog. 2. From the list of applications, click +Add for the application that you wish to add. 3. On the Basic Information page, specify the application name and click Next Step. Note: The following IDP-initiated configuration works for both IDP-initiated and SP- initiated connections. 4. In the Initiate SAML Workflow section, select IDP -initiated. 2 Copyright 2016 EMC Corporation. All Rights Reserved.

3 5. Under Issuer Entity ID, click Override and enter urn:uri:<idp_id> in the field. Note: The <idp_id> value must match the value defined on page 9 step 17 of the domain federation settings. 6. Scroll down to the SAML Response Signature section. a. Select Choose File and upload the RSA SecurID Access private key. b. Select Choose File and upload the RSA SecurID Access public certificate. c. Select the check box Include Certificate in Outgoing Assertion. 3 Copyright 2016 EMC Corporation. All Rights Reserved.

4 7. Scroll down to the Service Provider section. a. In the Assertion Consumer Service (ACS) URL field enter b. In the Audience (Service Provider Entity ID) field enter urn:federation:microsoftonline. 8. Scroll down to User Identity section. Set the Identifier Type to persistent and Property to objectguid. 9. Click Show Advanced Configuration. 10. Scroll down to Attribute Extension. 11. In the Attribute Name field, enter ImmutableID; and in the Property field, enter objectguid. 12. In the Attribute Name field, enter IDP ; and in the Property field, enter mail. 4 Copyright 2016 EMC Corporation. All Rights Reserved.

5 13. Under Uncommon Formatting SAML Response Options, select Assertion within response. 14. Click Next Step. 15. On the User Access page, select the desired user policy from the drop down list. 16. Click Next Step. 5 Copyright 2016 EMC Corporation. All Rights Reserved.

6 17. On the Portal Display page, select Display in Portal. 18. Click Save and Finish. 19. Click Publish Changes. Your application is now enabled for SSO. Next Steps Configure Office 365 to Use RSA SecurID Access as an Identity Provider 6 Copyright 2016 EMC Corporation. All Rights Reserved.

Configure Office 365 to Use RSA SecurID Access as an Identity Provider Note: Refer to Microsoft TechNet library page Prepare for single sign-on for full details on Office 365 configuration.

4. Select Add a domain. Note: Access to domain registrar is required to set the TXT flag in the host file to allow Microsoft to validate the domain. 5.

7 Configure Office 365 to Use RSA SecurID Access as an Identity Provider Note: Refer to Microsoft TechNet library page Prepare for single sign-on for full details on Office 365 configuration. Procedure 1. Login into the Office 365 portal using an enterprise admin account Select the Admin app. 3. Select DOMAINS. 4. Select Add a domain. Note: Access to domain registrar is required to set the TXT flag in the host file to allow Microsoft to validate the domain. 5. Complete the prerequisite steps to enable your domain in Office Go to the USERS > Active Users. 7. Select Active Directory synchronization: Set up. 8. Complete the configuration steps and click Activate. Synchronization may take up to 24 hours. 7 Copyright 2016 EMC Corporation. All Rights Reserved.

8 9. In the Active Directory synchronization: Set up, step 3 has a link to download and install the Directory Sync tool. The Installation process may take up to 20 minutes. 10. Run Directory Sync, you will be prompted for your Office 365 admin credentials and your local AD admin credentials. Do not check the hybrid deployment or password sync checkboxes. 11. Click Next and Finish. 12. Install Windows Azure Active Directory Module for Windows Powershell. The install requires Microsoft Online Services Sign-In Assistant for IT Professionals RTW. You will need to restart your server after installing Microsoft Online Services Sign-In Assistant and before installing the Azure AD Module for Windows Powershell. Note: If you are installing the Directory Sync on the same server you must use the version of Microsoft Online Services Sign-In Assistant required by Directory Sync. To avoid a version conflict, install Directory Sync first. 13. Launch the Powershell window and run the cmdlet commands to enable federation. 14. Type $cred=get-credential. 15. You will be prompted for the Microsoft Office 365 administrator credentials. The username must be in the format <username>@<domain>.onmicrosoft.com. The credentials will now be stored in variable $cred. Note: Do not login to the Azure Active Module for Windows PowerShell with the domain administrator account for the domain you are enabling federation for. This will lock you out of your Office 365 account if you do not have an administrator account with address. 8 Copyright 2016 EMC Corporation. All Rights Reserved.

9 Some commonly used PowerShell Connect-MsolService - Connect your PowerShell to an Office 365 tenant as an administrator Set-MsolDomainFederationSettings - Set most settings for Office 365 related to a domain Get-MsolDomainFederationSettings - Displays the settings for Office 365 for a domain Set-MsolDomainAuthentication - Change the way users authenticate and set various settings for a domain 16. Type Connect-MsolService Credential $cred. 17. Create the following variables and run the as seen below. $domain = <your_domain> $idpurl = <IDP_URL_From_RSASecurID AccessAccess> see page 3 step 5 $idpid = <IDP_EntityID_From_RSASecurID AccessAccess> Entity ID must be in urn:uri format $logouturl = <Your_Portal_logout_URL> IE: $cert = <Full_base64_encoded_value_of_Cert> or $certdata Note: To create $cert copy and paste the cert.pem file from the certificate bundle downloaded from the RSA SecurID Access administration console. To create $certdata, follow the 2 step procedure below to create the $certdata. First run the command: $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("c:\temp\saml.crt") where, c:\temp\saml.crt is the path to the RSA SecurID Access certificate. Next, type: $certdata = [system.convert]::tobase64string($cert.rawdata) In this example $domain = pe-lab.com $idpurl = $idpid = urn:uri:o365 $logoffurl = Run the Set-MsolDomainAuthentication command. Set-MsolDomainAuthentication DomainName $domain FederationBrandName $domain -Authentication Federated PassiveLogOnUri $idpurl SigningCertificate $certdata IssuerUri $idpid -LogOffUri $logouturl PreferredAuthenticationProtocol SAMLP Note: If you need to set the domain back to non federated run the command: Set-MsolDomainAuthentication DomainName name Authentication Managed Note: To change the PreferredAuthenticationProtocol between SAMLP and WSFED you must first set Authentication to Managed rather than Federated. 9 Copyright 2016 EMC Corporation. All Rights Reserved.

11 20. Login to the Office 365 portal. 21. Go to users and verify your users have been propagated to Office 365 cloud service. 22. Select the desired synced user and then click the Activate synced users link under quick steps. GLS 11 Copyright 2016 EMC Corporation. All Rights Reserved.

RSA SecurID Access Configuration for Microsoft Office 365 STS (Secure Token Service)

RSA SecurID Access Configuration for Microsoft Office 365 STS (Secure Token Service) Last Modified: April 17, 2017 RSA SecurID Access offers two methods to integrate with Microsoft Office 365. Both solutions