Enabling SSO authentication using the CLI

SSO authentication can be configured by an appliance Admin user logged in to the CLI of a Helix appliance in the IAM organization.

Important

OIDC‑based authentication and X.509‑based authentication are mutually exclusive. Trellix IAM uses OIDC-based authentication. If you use Trellix IAM, do not enable the use of Common Access Cards (CAC) or Personal Identity Verification (PIV) smart cards. Both CAC and PIV use the X.509 standard for a Public Key Infrastructure (PKI) as an authentication mechanism to manage certificates.

See IAM overview and Common Access Card (CAC) for certificate authentication.

If SSO authentication is disabled, it automatically changes to required if Helix mode is changed to on‑premises with the single sign-on option.

Prerequisites

Your Trellix IAM organization and user accounts are configured. See IAM overview
Admin access to a Helix appliance CLI.

To enable SSO authentication:

Go to configuration mode.

hostname > enable
hostname # configure terminal

Enable SSO authentication. Do one of the following:
To enable SSO authentication on a managed on-premises appliance:
1. Enable Helix mode.
  hostname (config) # helix mode on-premises
2. Enable SSO authentication.
  - To require SSO authentication, use the following command:
    hostname (config) # aaa authentication oidc web policy required
  - To make SSO authentication optional, use the following command:
    hostname (config) # aaa authentication oidc web policy allowed
  To require SSO authentication on a standalone on‑premises appliance:
  - Use the following CLI configuration command to put the appliance in Helix mode and set SSO authentication mode to required:
    hostname (config) # helix mode on‑premises with‑sso
To require SSO authentication on a standalone on‑premises appliance:
- Use the following CLI configuration command to put the appliance in Helix mode and set SSO authentication mode to required:
  hostname (config) # helix mode on‑premises with‑sso
For all other cases:
1. Enable Helix mode.
  - For a cloud-managed appliance, use the following command:
```
hostname (config) # helix mode cloud 
```
  - For an on-premises appliance, use the following command:
```
hostname (config) # helix mode on-premises
```
2. Set SSO authentication to required.
```
hostname (config) # aaa authentication oidc web policy required
```
Verify your changes. Use the following commands, as described in Viewing Helix mode and SSO authentication mode using the CLI.
- hostname (config) # show helix
- hostname (config) # show aaa authentication oidc
(the Enabled field of the show helix command output displays yes),
(Optional) After the appliance is running in Helix mode, you can use the following command to administratively disable SSO authentication without causing the appliance to exit Helix mode:
hostname (config) # aaa authentication oidc web policy disabled
Save your changes.
```
hostname (config) # write memory
```