Privacera Platform

1. Sign in to your PingIdentity account.

2. Under Your Environments , click Administrators.

3. Select Connections from the left menu.

4. In the Applications section, click on the + button to add a new application.

5. Enter an Application Name (such as Privacera Portal SAML) and provide a description (optionally add an icon). For the Application Type, select SAML Application. Then click Configure.

6. On the SAML Configuration page, under "Provide Application Metadata", select Manually Enter.

7. Enter the ACS URLs:

   https://<portal_hostname>:<PORT>/saml/SSO

   Enter the Entity ID:

   privacera-portal

   Click the Save button.

8. On the Overview page for the new application, click on the Attributes edit button. Add the attribute mapping:

   user.login: Username

   Set as Required.

   Note

   If user’s login id is is not the same as the username, for example if user login id is email, this attribute will be considered as username in the portal. The username value would be email with the domain name (@gmail.com) removed. For example "john.joe@company.com", the username would be "john.joe". If there is another attribute which can be used as the username then this value will hold that attribute.

9. You can optionally add additional attribute mappings:

   user.email: Email Address 
   user.firstName: Given Name
   user.lastName: Family Name

10. Click the Save button.

11. Next in your application, select Configuration and then the edit icon.

12. Set the SLO Endpoint:

    https://<portal_hostname>:<PORT>/login.html

    Click the Save button.

13. In the Configuration section, under Connection Details, click on Download Metadata button.

14. Once this file is downloaded, rename it to:

    privacera-portal-aad-saml.xml

    This file will be used in the Privacera Portal configuration.

Now we will configure Privacera Portal using privacera-manager to use the privacera-portal-aad-saml.xml file created in the above steps.

1. Run the following commands:

   cd ~/privacera/privacera-manager/
   cp config/sample-vars/vars.portal.saml.aad.yml config/custom-vars/

2. Edit the vars.portal.saml.aad.yml file:

   vi config/custom-vars/vars.portal.saml.aad.yml

   Add the following properties:

   SAML_ENTITY_ID: "privacera-portal"
   SAML_BASE_URL: "https://{{app_hostname}}:{port}"
   PORTAL_UI_SSO_ENABLE: "true"
   PORTAL_UI_SSO_URL: "saml/login"
   PORTAL_UI_SSO_BUTTON_LABEL: "Single Sign On"
   AAD_SSO_ENABLE: "true"

3. Copy the privacera-portal-aad-saml.xml file to the following folder:

   ~/privacera/privacera-manager/ansible/privacera-docker/roles/templates/custom

4. Edit the vars.portal.yml file:

   cd ~/privacera/privacera-manager/
   vi config/custom-vars/vars.portal.yml

   Add the following properties and assign your values.

   SAML_EMAIL_ATTRIBUTE: "user.email"
   SAML_USERNAME_ATTRIBUTE: "user.login"
   SAML_LASTNAME_ATTRIBUTE: "user.lastName"
   SAML_FIRSTNAME_ATTRIBUTE: "user.firstName"

5. Run the following to update privacera-manager:

   cd ~/privacera/privacera-manager/
   ./privacera-manager.sh update

   You should now be able to use Single Sign-on to Privacera using PingFederate.