You can configure ZCSPM as the service provider (SP) and user Security Assertion Markup Language (SAML) Single-Sign-On (SSO) for authenticating and provisioning users. To learn more about SAML, see About SAML.

Configuring SAML

To configure SAML based SSO with ZCSPM:

• 1. Download Metadata from the ZCSPM Admin Portal
  1. Go to Configurations > Identity Providers.
  2. Click Add IdP Configuration.
  3. Click Download XML Metadata.

  See image.

  

  Close

  The XML Metadata contain the following information which you need to submit at your IdP:

  • Name Identifier Format: ZCSPM only supports email address as the Name ID format.
  • Entity ID: A unique identifier for a SAML entity.
  • Assertion Consumer Service (ACS) URL: ZCSPM destination URL where the SAML response must be sent to by the IdP.

  Close
• 2. Configure the IdP for SAML

  Follow the relevant configuration guides to configure ZCSPM as an SP for your IdP:

  • Okta
    1. Log in to Okta with admin privileges.
    2. From the left-pan menu, click Applications.
    3. Click Create App Integration.
    4. Select SAML 2.0, then click Next.
    5. In the General Settings tab, enter your App name and click Next.
    6. Enter the ACS URL from the downloaded metadata at the Single sign on URL.
    7. Enter the Entity ID from the downloaded metadata at the Audience URI.
    8. From the Name ID format drop-down menu, select EmailAddress.

    See image.

    

    Close

    9. Under Attribute Statements, add attributes with the following Attribute Values:
       • user.firstName
       • user.lastName
    10. Click Next.
    11. Select I'm an Okta customer adding an internal app, then click Finish.
    12. In the Sign On tab, click View Setup Instructions. You can view the following information which you need to submit at ZCSPM:
        • Identity Provider Single Sign-On URL
        • Identity Provider Issuer
        • X.509 Certificate

    Close
  • PingOne
    1. Log in to PingOne with admin privileges.
    2. Go to Connections > Applications.
    3. Click Add Application, then select WEB APP.
    4. Choose SAML as your connection type.
    5. Enter the Application Name, then click Next.
    6. Click Import Metadata, then upload the XML metadata you downloaded from the ZCSPM Admin Portal.
    7. Enter the Assertion Validation Duration, then click Save and Continue.
    8. From the PingOne User Attribute drop-down menu, select Family Name.
    9. Click Save and Close.
    10. Select your application, then click the Configuration tab.
    11. Download the Metadata. The metadata contains the following information which you need to submit at ZCSPM:
        • Identity Provider Single Sign-On URL
        • Identity Provider Issuer
        • X.509 Certificate

    See image.

    

    Close

    Close
  • OneLogin
    1. Log in to OneLogin with admin privileges.
    2. Click Applications, then click Add App.
    3. Search for SAML, then select the SAML Test Connector (Advanced) connector.
    4. Enter the Display Name, then click Save.
    5. In the Configuration tab:
       • Enter the ACS URL from the downloaded metadata at the ACS (Consumer) URL.
       • Enter the following URL at the ACS(Consumer) URL Validator:

       https:\/\/app.cloudneeti.com\/auth\/saml\/acs

       • Enter the Entity ID from the downloaded metadata at the Audience (EntityID) field.
    6. Go to the SSO tab. You can view the following information which you need to submit at ZCSPM:
       • Identity Provider Single Sign-On URL
       • Identity Provider Issuer
       • X.509 Certificate

    See image.

    

    Close

    Close

  Close
• 3. Add the IdP in the ZCSPM Admin Portal
  1. Go to Configurations > Identity Providers.
  2. Click Add IdP Configuration.
  3. Enter the IdP's Name.
  4. Enter the Identity Provider Issuer.
  5. Enter the Single Sign On URL.
  6. Upload the IdP Certificate.
  7. Click Add.

  Close
• 4. Add Users on ZCSPM

  You need to add the users on ZCSPM after configuring SAML based authentication. You can add the users as a License User or an Account User.

  Close

Configuring SAML Just In Time (JIT) provisioning

To configure SAML JIT provisioning with ZCSPM:

• 1. Enable JIT on the ZCSPM Admin Portal
  1. Go to Configurations > Identity Providers.
  2. Click the Update IdP icon.
  3. Enable JIT User Provisioning.
  4. Click Update.

  See image.

  

  Close

  Close
• 2. Create two custom user attributes on your IdP
  • CspmRole: Must be LicenseAdmin or LicenseReader. ZCSPM will not be able to provision the user if there are any other values.
  • LicenseId: The role access will be given for this specific license. If left empty, the user will be granted permission to all the licenses in your organization.

  Follow the relevant configuration guides to create the custom attributes:

  • Okta
    1. Log in to Okta with admin privileges.
    2. From the left-pan menu, click Directory.
    3. Click Profile Editor, then click Profile next to User (default).
    4. Under Attributes, click Add Attributes.
    5. Enter the Display name and the Variable name.
    6. Click Save.

    See image.

    

    Close

    7. Go to Directory > People.
    8. Select a user you want to assign the ZCSPM application.
    9. Click the Profile tab, then click Edit.
    10. For the ZCSPM Role field, enter LicenseAdmin or LicenseReader.
    11. From the left-pan menu, click Applications.
    12. Select your ZCSPM application.
    13. Go to the General tab, then click Edit next to SAML Settings.
    14. Click Next.
    15. Under Attribute Statements, add the CspmRole attribute with the user.CspmRole value.

    See image.

    

    Close

    16. Click Next, then click Finish.

    Close
  • PingOne
    1. Log in to PingOne with admin privileges.
    2. Go to Identities > Attributes.
    3. Click Add Attribute, then select DECLARED.
    4. Click Next.
    5. Enter CspmRole in the NAME field.
    6. Enter the DISPLAY NAME and DESCRIPTION.
    7. Click Save and Close.

    See image.

    

    Close

    8. Create another attribute with LicenseId in the NAME field.
    9. Go to Connnections > Applications.
    10. Select Attribute Mappings, then click ADD ATTRIBUTE.
    11. Select the CspmRole attribute.
    12. Enter LicenseAdmin or LicenseReader.
    13. Click Save.

    See image.

    

    Close

    Close
  • OneLogin
    1. Login to OneLogin with admin privileges.
    2. Click Users > Custom User Fields.
    3. Click New User Field.
    4. Enter CspmRole in the Name field.
    5. Enter the Shortname, then click Save.

    See image.

    

    Close

    6. Create another custom user field with LicenseId in the Name field.
    7. Click Applications, then select the ZCSPM SSO application.
    8. Click Users, then select a user.
    9. Enter LicenseAdmin or LicenseReader in the CspmRole field.
    10. (Optional) Enter the ZCSPM license ID in the LicenseId field.

    See image.

    

    Close

    If you are creating a new user for ZCSPM, you need to enter this information when creating the user.

    11. Click Save.

    Close

  Close