Connect Web Apps via SAML with Evo: Version 3
Is your favorite 3rd party app not listed as a tile? No worries! Multi-factor authentication (MFA) is possible with Evo and your SAML supported web applications. Not all options will be used, so please refer to your 3rd party web-app to see which will be needed.
Version 3 will be handled exclusively through the New UI. You can select access to the new User Interface from the homepage on the Old UI or the upper right menu to switch into the new portal.
Prerequisites:
If you haven't done so already, please create an SSO Reset Frequency Rule.
Note: If you don't see the updated SAML configuration options please check your Role Based Permissions settings and select all applications permissions (Manage Applications and Manage Application Permissions)
Setup
- Select your tenant you want to link from the left side menu
- Select Applications from the left nav menu.
- Open the Applications menu and select New from the upper right
Select the SAML Web App card
Now the SAML configuration page will be present
- Enter the Entity ID of your SAML provider
- Enter your Assertion Consumer Service (ACS) URL from your provider (Must be in URL format)
- (Optional) Enter your Single Logout Service (SLO) URL from your provider (Must be in URL format)
- Your provider will have data in the XML for AuthnRequestsSigned and WantAssertionsSigned
- Select the appropriate options from your data (Disabled/Enabled)
- Example: <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
- AuthnRequestsSigned: Login requests are signed via your signing certificate
- WantAssertionsSigned: Assertions are encrypted after the login process is completed and the process of Evo returning the SAML response
- If your requests need to be encrypted, you will need to configure the subsequent Certificates section
Certificates
- Add any certificates that are needed via the New+ tab
- Note: we are initially only allowing 1 encryption or 1 signing certificate or 1 certificate for both. Multiple certificates will be supported at a later date.
- If no toggles are enabled, it will be considered that the certificate is used for both signing and encryption
- Also add any Attributes that are needed for configuration
- We allow attributes to be created with any predefined values in the drop down.
- We also allow a custom static text value if needed.
- If no attributes are provided, we will provide a default return value as part of the SAML Assertion that just includes a NameID
Once all attributes are configured, select the save option at the bottom right
Retrieve the URLs, Fingerprints and public certificate from Evo
Once completed, the setup instructions can be found in the upper right of the configuration page.
Take this information and provide it to your application to setup the SAML access.
Please reach out to the support team with any questions!