Security Assertion Markup Language (SAML) extends the Single Sign-On (SSO) standard to authenticate and authorize users.
SAML is an XML and Web based open standard protocol for federated authentication and authorization processes between separate identity providers and service providers. SAML shares or "federates" user identities within a network.
SAML configuration involves these roles:
Users—a human user that requests a service from the service provider. Also known as a principal.
Identity provider (IdP)—the entity that does authentication assertions with a single sign-on (SSO). The IdP is a third-party service that creates, manages, and verifies the authenticity of the user within a federation or distributed network. Examples of an IdP are Okta and Microsoft Active Directory Federation Services (ADFS).
Service provider (SP)—the entity that uses the IdP to authenticate the identity of the user so that it can authorize access to its services. The Trellix appliance operates as the SAML SP.
Important
Your SAML IdP solution depends on your security and network requirements. Refer to your IdP server installation and configuration documentation to integrate with Trellix appliances.
SAML passes credentials about users, logins, and attributes between the IdP and SP. The credentials are in the form of assertions. An assertion is an XML metadata file that the IdP posts to a location that the SP retrieves. The metadata contains the user's identify or profile.
With SAML, the user only needs to log in once using single sign-on (SSO) on the Trellix appliance. The user log in generates an SP authentication SAML request that is redirected to the IdP via the Web UI. When the request is received, the IdP generates and returns a SAML authentication response that contains the stored user attributes back to the SP.
For SAML authentication and authorization to work:
An Assertion Consumer Service URL (ACS Endpoint) must be configured on the IdP
An IdP login URL must be configured on the Trellix appliance operating as an SP.
This information is the metadata that is configured on the IdP and SP. See Configuring SAML authorization.