Configure Generic SAML Integration¶

The steps to configure Generic SAML are as follows.

Step 1: SSH into Privacera Instance¶

SSH into the instance where Privacera is installed.

Step 2: Navigate to Privacera Manager Directory¶

1

cd ~/privacera/privacera-manager

Step 3: Copy the saml Sample Configuration File¶

Copy the sample saml configuration file to the custom configuration directory.

1

cp config/sample-vars/vars.portal.saml.aad.yml config/custom-vars/

Step 4: Edit the Configuration File¶

Open the configuration file using a text editor and update the required fields.

1

vi config/custom-vars/vars.portal.saml.aad.yml

Uncomment and edit the following properties:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

SAML_ENTITY_ID: "privacera_portal"
SAML_BASE_URL: "https://<your-privacera-host>:6868"
PORTAL_UI_SSO_ENABLE: "true"
PORTAL_UI_SSO_URL: "saml/login"
PORTAL_UI_SSO_BUTTON_LABEL: "SSO Login"
AAD_SSO_ENABLE: "true"

SAML_EMAIL_ATTRIBUTE: "UserId"
SAML_USERNAME_ATTRIBUTE: "Email"
SAML_LASTNAME_ATTRIBUTE: "LastName"
SAML_FIRSTNAME_ATTRIBUTE: "FirstName"

If you have configured Group Attribute, uncomment and edit the following properties:

1

SAML_GROUP_ATTRIBUTE: "Group"

Step 5: Rename the downloaded metadata XML file¶

1. Locate the metadata file downloaded in Step 4, (usually in your Downloads folder or the folder where you saved it).
2. Rename the file to privacera-portal-aad-saml.xml

Step 6: Upload or Copy the File to Privacera Manager’s custom properties folder¶

Option 1: Using SCP (for Remote Servers)¶

1. Open a terminal and run the following command to upload the file to the Privacera Manager’s custom properties folder:

   Bash
   1	scp ./privacera-portal-aad-saml.xml user@<server-ip>:~/privacera/privacera-manager/config/custom-properties/

   Replace <server-ip> with your server’s IP address and user with your username.

Option 2: Copy-Paste Locally¶

1. If the file is on the same server, move the privacera-portal-aad-saml.xml file to the home directory.

2. Use the following command to copy it to the custom properties folder

   Bash
   1	cp ./privacera-portal-aad-saml.xml ~/privacera/privacera-manager/config/custom-properties/

   Ensure the privacera-portal-aad-saml.xml file is in the correct directory before running the cp command.

Step 7: Update Privacera Manager¶

1
2

cd ~/privacera/privacera-manager/
./privacera-manager.sh update

Step 8: Optional - Restart Privacera Portal in Azure Kubernetes Environment¶

If you are configuring SSL in an Azure Kubernetes environment, restart the Privacera Portal to apply the changes.

1

./privacera-manager.sh restart portal

Step 9: Role Mapping For SAML (Optional)¶

Role mapping allows you to translate roles or groups from your SAML Identity Provider (IdP) into specific roles within Privacera. This ensures that users have the correct permissions and access when they log into Privacera.

What is Role Name Attributes?¶

This attribute in your Identity Provider (IdP) contains the user's roles or group information. It identifies the roles or groups the user belongs to in the IdP.

What is Role Mapping?¶

This configuration maps Identity Provider roles/groups to Privacera Portal roles. Matching roles are assigned to users; otherwise, the default role configured in the PORTAL_SSO_DEFAULT_USER_ROLE property in Privacera Manager is applied, or ROLE_USER if unspecified.

In Privacera, follow these steps to access the SAML Role mapping settings:

1. Go to the Settings menu.
2. Navigate to SSO Role Mapping.
3. Click on SAML tab.

Reference image of Role Mapping form Privacera:

Example:¶

• Mapped Privacera Role: ROLE_SYS_ADMIN
• Identity Provider (IdP) Role or Group: saml_admin

In this example, if a user has the saml_admin role in the SAML Identity Provider, they will automatically be assigned the ROLE_SYS_ADMIN role in Privacera.

Step 10: Verify SSO Login¶

Once the setup is complete, navigate to the Privacera Portal login page. You should see an SSO Login button. Use this to log in with your SSO credentials.

In PrivaceraCloud, follow these steps to configure a Generic SAML-based Single Sign-On (SSO):

1. Go to the Settings menu.
2. Navigate to Identity.
3. Click on Single Sign-On.

These variables ensure seamless integration between Generic SAML and Privacera for SAML-SSO.

Role Mapping For Generic SAML¶

Role mapping allows you to translate roles or groups from your SAML Identity Provider (IdP) into specific roles within Privacera. This ensures that users have the correct permissions and access when they log into Privacera.

What is Role Name Attributes?¶

This attribute in your Identity Provider (IdP) contains the user's roles or group information. It is used to identify the roles or groups the user belongs to in the IdP.

What is Role Mapping?¶

This configuration maps roles or groups from the Identity Provider (IdP) to corresponding roles in Privacera.If a specific role from the Identity Provider (IdP) matches a role defined in the role mapping configuration, that role is assigned to the user in Privacera. If no mapping is defined, the default role, ROLE_USER, is automatically assigned to the user.

Reference image of Role Mapping form PrivaceraCloud:

Example:¶

• IdP Role or Group: example_role
• Mapped Privacera Role: ACCOUNT_ADMIN

In this example, if a user has the role example_role in Generic SAML, they will automatically be assigned the ACCOUNT_ADMIN role in Privacera.

By properly configuring role mapping, you ensure that users are granted appropriate access levels within Privacera based on their roles or group memberships from the Identity Provider (IdP). This simplifies user management and ensures seamless integration with your organization’s existing identity infrastructure.

Once the configuration is complete, you can test the setup by attempting to log in to PrivaceraCloud using your SSO credentials. This will help verify that the Single Sign-On (SSO) integration is working correctly.