Single sign-on (SSO) is a convenient and secure way to authenticate multiple applications using one set of logon credentials through an Identity Provider (IdP). With SSO, you can log on to the Trellix applications directly from your enterprise IdP.
IAM allows users to configure single sign-on (SSO) to login to their applications using external identity providers.
You can also assign Roles to your external IDP Groups.
In the example above, the external IDP group, My-Idp_Group is mapped to the custom role, Test Administrator on the IAM. External IDP users who are a part of the My-Idp_Group group will now automatically be assigned the role, Test Administrator when they use SSO to login to applications.
Note
A tenant administrator can map the external IdP groups to IAM roles on the users and roles management page.
To enable SSO for your Trellix account:
Configure the IdP application.
Note
Make sure that your IdP application is configured with signature algorithm — SHA-256.
Input your Security Assertion Markup Language (SAML) configuration information.
Note
You can configure the account with only one IdP.
Enable SSO by following the process below:
Define group(s) and attributes in your external IdP
Mapping external IdP to IAM roles
Update your external IdP
Create IdP groups
Define group(s) and attributes in your external IdP
Follow the steps below to define group(s) and attributes in your external IdP
Create Groups: In your IdP service provider, create groups to represent different user categories based on permissions or responsibilities and assign users. For example,
AdminorViewer.Custom Attributes: Send the custom attributes via SAML.
Note
Ensure that the custom attributes from the external IdP are available in the SAML.
Add new attributes and group attributes.
The new group attribute will be transmitted as part of the SAML assertion.
To include all groups, use regex in the Group Attribute Statements section (e.g., .*).
Set up the application settings with the following details:
App Name: Enter the name for your Single Sign-on solution.
Single sign-on URL
Audience URL
Set Default Relay State to auth.ui.trellix.com
Note the Issuer ID value and the Single Signon Service values.
Download signing certificates, if any.
Save and validate the SAML response.
Mapping external IdP to IAM roles
Follow the steps below to define how roles from an external IdP translate into roles within your IAM system.
Login as a tenant administrator to the IAM. On the dashboard, navigate to the Identity Provider settings page.
Click Edit on the top-right of the page.
Enter the Issuer. (See step 2c in the previous process.)
Upload the Certificate. (See step 2d in the previous process.)
In Login URL, enter the Single Signon Service. (See step 2c in the previous process.)
You can keep Request Binding as HTTP-POST or you may also set it to HTTP-REDIRECT
In the IdP Group Claim field, enter the key that contains the list of IdP groups in the SAMLResponse.
Note
Ensure to enter a valid attribute value in the IdP group Claim field. Otherwise, Groups section will not be listed in the Users and Roles page.
IDP groups should be same as group name as you defined in your external IdP.
Click Save at the bottom of the page.
After successfully saving the configuration, you can view the information in the Service Provider (Trellix) section.
Audience — Edit your IdP application's SAML settings to update the Audience URI.
Assertion Consumer Service URL — Edit your IdP application's SAML settings to include the SSO URL.
Certificate — Download the certificate. Some IdPs require the Trellix ePO - SaaS service provider certificate.
SAML Metadata — Download the SAML metadata. It contains another configuration which your IdP require.
From the User List, select the users that you want to exempt from SSO.
Important
IMPORTANT: Ensure at least one administrator is exempt before saving the IdP configuration. Users marked as exempt from SSO are allowed to login with their Trellix username and password and via IDP.
Configure your IdP application to send these user attributes to the IdP provider. The possible schemas provided here is for reference only. These schemas can vary depending on the IdP provider.
First Name — user.firstName (Possible schema of http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstname or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname)
Last Name — user.lastName (Possible schema of http://schemas.xmlsoap.org/ws/2005/05/identity/claims/lastname or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname)
Email — user.email (Possible schema of http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress)
Unique User Identifier — user.email (Possible schema of http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress)
Set your Unique User Identifier to email address. We only accept email address as the primary identifier for users.
Once you change Unique User Identifier from first name or last name to use an email address, the updated certificate has to be downloaded from IdP application and upload again in the Identity Provider.
Update your external IdP
Update the required attributes from the Identity provider page to your external IdP.
Create IdP groups
Create IdP groups
Login as a tenant administrator to the IAM. On the dashboard, navigate to the Manage Users settings page.
Click Add IdP Group.
A form will appear in the right pane. Enter a name of the group and select the roles you want to assign to the group.
Important
Ensure to specify the group name as mentioned in your IdP service provider.
Click Save to create the new IdP group. You can also click Cancel to cancel changes.
What's Next?
Go to your organization’s domain in IdP platform. For example, myorg.okta.com.
Log in using the admin credentials and select the newly configured application. You are redirected to the Trellix product selection page.
Select a product and verify the configuration with the allowed admin activities.
Perform test logins with users assigned to different groups to ensure roles are mapped correctly.
Check for user access levels, permission applied to each role, any errors or unintended mappings.
Once the testing is successful, deploy the changes to your application. Users should now be able to log in using SSO.
Troubleshooting
Error message: Misconfigured identity provider. Check your configuration and try again appears during logon if any of these conditions are true.
IdP SSO or Trellix IdP is not configured properly.
Unique User Identifier in IdP application is changed to an email address, the updated certificate is not uploaded again in the Identity Provider.
Error message: Welcome <user>, where do you want to sign in? There are no applications available.
Solution: The user logon using SSO has not been added to the Trellix tenancy, invite the user to the tenant and grant appropriate roles.
Error message: invalid_client, authorize endpoint: No tenant id available.
Solution: The user logon has been disabled in the tenant. From the Users and Roles page, select the user and choose 'Enable' to allow login.
Review the following parameters also:
Verify mappings are correctly defined in IAM or the external IdP.
Check for typos in attribute names or values.
Ensure attributes are added in both the external IdP and IAM configurations.
Verify that the SAML assertion includes the required attributes.
Contact Trellix Support if you encounter any errors.