Configuring Sso Authentication Using Saml Browser Post Profile - Cisco PIX 500 Series Configuration Manual

Getting Started

Configuring SSO Authentication Using SAML Browser Post Profile

This section describes configuring the security appliance to support Security Assertion Markup
Language (SAML), Version 1.1 POST profile Single Sign-On (SSO) for authorized users. SAML SSO
is supported only for clientless SSL VPN sessions. This section includes:
•
•
•
After a session is initiated, the security appliance authenticates the user against a configured AAA
method. Next, the security appliance (the asserting party) generates an assertion to the relying party, the
consumer URL service provided by the SAML server. If the SAML exchange succeeds, the user is
allowed access to the protected resource.
Figure 37-1
Browser
Note The SAML Browser Artifact profile method of exchanging assertions is not supported.
Task Overview: Configuring SSO with SAML Post Profile
This section presents an overview of the tasks necessary to configure SSO with SAML Browser Post
Profile. These tasks are:
•
•
•
•
Optionally, in addition to these required tasks, you can do the following configuration tasks:
•
•
After completing the configuration tasks, you assign an SSO server to a user or group policy.
Cisco Security Appliance Command Line Configuration Guide
37-12
Task Overview: Configuring SSO with SAML Post Profile
Detailed Tasks: Configuring SSO with SAML Post Profile
SSO Server Configuration
SAML Communication Flow
User Login
User
Applications
Access to
Applications
Specify the SSO server with the sso-server command.
Specify the URL of the SSO server for authentication requests (the assertion-consumer-url
command)
Specify the security appliance hostname as the component issuing the authentication request (the
issuer command)
Specify the trustpoint certificates use for signing SAML Post Profile assertions (the trustpoint
command)
Configure the authentication request timeout (the request-timeout command)
Configure the number of authentication request retries (the max-retry-attempts command)
Figure 37-1 shows the communication flow:
SAML SSO
Assertion
Security
Redirection to
Applications
Portal (with
cookie)
Chapter 37 Configuring Clientless SSL VPN
Protected
SAML
Resource
Server
URL
(Web Agent)
OL-12172-03