You define custom SAML attributes with a specific user role and access level for SAML users.
Custom attributes for authorization required by Trellixappliances SPs should be configured on the SAML IdP server. Refer to your IdP server documentation.
The following vendor specific custom attributes are supported for all Trellix appliances configured as a SAML SP:
appliance.role.cms—Central Management System
appliance.role.wmps—Network Security
appliance.role.emps—Email Security — Server
appliance.role.fmps—File Protect
appliance.role.mas—Malware Analysis
appliance.role.hx—Endpoint Security (HX)
appliance.role.default—used for any designated Trellix appliance configured as an SP.
When a user logs into a Trellix appliance through an SAML IdP server authorization, the user must be first mapped to one of the following user roles:
admin
analyst
auditor
monitor
operator
Note
The Trellix appliance expects these attributes as a key-value pair.
User role mapping examples
Guidelines
The "appliance.role.<product type>" attribute takes precedence over the "appliance.role.default" attribute.
The "appliance.role.default" attribute can be configured on the IdP server or the backend LDAP database where you define the user attributes.
The user privileges are restricted to the product specified in the attribute name and value configuration.
The user privileges are asigned for each product specified in the "appliance.role.<product type>" attribute.
Example 1—Assigning a default role to a user on all appliances
Configure the "appliance.role.default” attribute to user “enterpriseadmin1” to grant admin privileges on all appliances.
User name | Assigned role | Product type | IdP configuration | |
|---|---|---|---|---|
enterpriseadmin1 | admin | All | Attribute Name | Value |
appliance.role.default | admin | |||
In this example, the user "enterpriseadmin1" is assigned the admin role on the Central Management System, File Protect, and Network Security SP appliances.
Example 2—Assigning a specific user role on a specific appliance
Configure the "appliance.role. <product type>" attribute for a specific user.
User Name | Assigned Role | Product Type | IdP Configuration | |
|---|---|---|---|---|
cmsadmin1 | monitor | cms | Attribute Name | Value |
appliance.role.cms | monitor | |||
In this example, the user "cmsadmin1" is assigned the monitor role on the Central Management System appliance SP.