Configuring SAML authentication

You can enable SAML authentication on your NDR appliance (service provider), so that remote users are authenticated by a SAML server (identity provider), before the users can access the NDR Web UI.

Prerequisites:

Access to the SAML server (IDP)
Configure the SAML server for NDR application

To configure SAML authentication on your NDR appliance:

Log into the CLI on your NDR appliance.
Enter privileged mode:
hostname > enable
Enter the admin password:
[sudo] password for <npadmin>: <password>
Enter configuration mode:
hostname # configure system

Enter the SAML Config menu:

npadmin@hostname(config)# saml

The SAML Config menu is displayed.

 = SAML Config
=======================================
Configure SAML Authentication

1. State  [allowed]
2. Attribute for username [sunil]
3. IDP metadata
4. Download SP metadata
5. TLS settings


Select a menu choice by number or an action by letter
					|
					|
					|
X - Exit menu                          |
			>

Press 1 to change the state of the SAML authentication.
In the displayed prompt, press 2, 3, or 4 to change the state of the SAML authentication to allowed, required, or required-force respectively.
```
 = Choose SAML state                                                     
=======================


1) disabled
2) allowed
3) required
4) required-force			 
```
- disabled: This mode allows the users to authenticate only though NDR. This is the default mode.
- allowed: This mode allows the users to authenticate either through NDR or SAML.
- required: This mode allows the users to authenticate only through SAML.
- required-force: This mode automatically redirects the users to the SAML authentication page. As long as the IDP session remains active, you cannot log out of your NDR appliance.
Press 2 to set the attribute for the user name. Select a letter corresponding to the action you wish to perform.
The user name attribute is used to get the username of the logged-in user. By default, the username is read from the NameID attribute.
Press 3 to configure the IDP metadata settings for SAML authentication:
1. To download the IDP metadata file to your Network Detection and Response appliance, press 1 and enter the metadata fetch URL at the prompt.
  You need to get this URL from the SAML server configuration settings.
2. (Optional) To upload the IDP metadata file to your Network Detection and Response appliance, press 3 and enter the filename of the IDP metadata file that you downloaded and is made available in the transfer directory.
3. To set the IDP connection timeout, press 2.
Press 4 to download the SP metadata file to the transfer directory. Use SCP to copy the SP metadata file to your Network Detection and Response appliance.
You need to upload this XML file to the SAML server.
Press 5 to configure the TLS settings for IDP connection for metadata download.
These TLS settings are used only while downloading the IDP metadata and these validate the SSL certificate of the IDP while connecting to it.
Press S to save the changes and exit.

Post-requisite: Configure the attributes for the users in the SAML server. We have the following roles: "appliance.role", "px.role" and "ia.role". The "appliance.role" can be used if the roles for a user are the same for both NDR and PX. The "ia.role" provides a finer role assignment for a NDR appliance. The possible values for these attributes are "uiapi" and "wheel".

A user will now see a SAML option in the login screen. When a user clicks Login with SAML, the sign-in screen of the SAML server is displayed, where the user needs to enter the SAML account credentials to access the NDR Web UI.