SAML authorization is done by the Trellix service provider (SP). The appliance grants access to the authenticated user after the IdP passes user authentication.
Custom attributes for authorization required by Trellix appliances should be configured on the IdP SAML server, but an alternate solution when the IdP does not support custom attribute definitions is to define authorization rules on the SP. Authorization rules take precedence over custom attributes that are defined on the IdP server.
You can configure SAML users for IdP to SP authorization by mapping them to local user accounts and granting them local role access privileges. Local users roles are passed as attributes under the Attribute Section of the XML assertion from the SAML IdP server.
To configure SAML authorization rules on the SP, use the following command options with the aaa authorization rules rule append tail comment command.
match-saml-nameidMatch Attribute element from SAML Assertionmatch-saml-attributeMatch NameID element from SAML Assertion
Example 1—Defining a rule to map a user name to a local user role
This example authorizes the admin user to log in to the SP in CMS monitor role.
hostname (config) # aaa authorization rules rule append tail comment "mapping monitor user to admin" map-local-user admin match-saml-nameid "cmsmonitor"
Example 2—Defining a rule to map an IdP attribute to a local user role
This example authorizes the user with the cmsadmin@exqa.com email address to log in to the SP in local monitor role.
hostname (config) # aaa authorization rules rule append tail map-local-user monitor match-saml-attribute "Email-Address:cmsadmin@exqa.com"
Note
To map the login user to a local user, use the match-saml-attribute value with the key-value pair to define the statement.
hostname # show aaa authorization rules
-------------------------------------------------------------- # AAA Auhorization Rules : Enabled -------------------------------------------------------------- # Rule Statements
-------------------------------------------------------------- # 1 Match saml namid : cmsmonitor -->Action Map Local User : admin Comment : mapping monitor user to admin # 2 Match saml attribute : Email-Address:cmsadmin@exqa.com -->Action Map Local User : monitor
Example 3—Defining a rule to map users to a default role
This example maps all IdP authenticated users to log in to the SP in the default monitor role.
hostname (config) # aaa authorization roles default monitor
hostname # show aaa authorization roles
ROLE DESCRIPTION admin System administorator: unrestricted privileges operator System operator: limited administrative privileges monitor System monitor: limited read-only privileges analyst Analyst: malware analysis auditor Auditor: viewing of audit logs api_analyst Analyst limited to Web Services API api_monitor Monitor limited to Web Services API fe_services FireEye Services
Example 4—Defining a rule to restrict access SAML groups to alerts on the Central Management System Appliance
This example defines a rule to restrict an access group to alerts that the Central Management System appliance receives from a managed SP appliance.
hostname (config) # aaa authorization access-groups rules rule append tail match-saml-nameid <access group name> match-saml-attribute <attribute>
For detailed information, see Configuring access groups for alerts.