Using VIP Access Manager as an IdP for the VIP Self Service Portal/My VIP
search cancel

Using VIP Access Manager as an IdP for the VIP Self Service Portal/My VIP

book

Article ID: 150874

calendar_today

Updated On:

Products

VIP Service

Issue/Introduction

 While Symantec Access Manager (SAM) is no longer a supported product, this article contains useful information when configuring access to the VIP SSP,  VIP My VIP, or VIP Manager through a 3rd-party provider. 

Resolution

In environments using VIP Access Manager (SAM) with a local authentication service only (i.e., no VIP Enterprise Gateway), or to simply consolidate SSO applications visible to end-users in the SSO Portal, it is possible to take advantage of the VIP Self-Service Portal or My VIP Portal. These portals allow users to manage and register their own VIP credentials without needing to contact the organization's help desk or a VIP administrator.

Instructions:

  1. Generate and export a VIP certificate in both PEM and PKCS#12 formats srom the VIP Manager. This process is detailed in this KB article.
  2. Import the PKCS#12 certificate to the SAM Admin Console under Platform > Certificates by clicking on Import Certificate.
  3. From the Admin Console in SAM, create a new application connector by going to Applications > Application Connectors in the top navigation bar and selecting the generic template under Symantec Applications.
    1. Give the connector a name and select the appropriate Access Policy.
    2. Use SAML 2.0 for the Connector Mode.
    3. Click Next.
    4. Fill in a Site Display Name that will be used to identify the application to users in the SSO Portal.
    5. Click Next.
    7. Use IDP-initiated mode.
      1. My VIP: https://login.vip.symantec.com/viplogin/saml2/SSO
    9. Set the SP Entity ID as https://ssp.vip.symantec.com/vipssp
      1. My VIP: https://login.vip.symantec.com/viplogin/saml2/SSO
    10. Click Next.
    11. Under SAML Identifier Information section:
      1. For the Identifier Type select Subject from the drop-down.
      2. The Identifier Attribute should match the desired VIP username format (i.e. sAMAccountName, UserPrincipalName, email address, etc). The current normalized attribute mappings can be reviewed under Users > Virtual ID Mapping.
    12. Click Next.
    13. Check and fill out the Override IdP Entity ID section using a unique value such as the connector ID string from the end of the IdP URL. For example, if the IdP URL is https://sso.corp.lab/ssg-saml/saml/userData?id=180f94a6-b3b5-465a-0000-92b463f40da8, the entity ID could be set to 180f94a6-b3b5-465a-0000-92b463f40da8. The IdP URL is unique to each application connector.
    14. Check Include SSG-IDP Certificate in Response and select the VIP certificate that was previously imported into SAM. Use SHA-1 for the signature algorithm.
    15. Click Next.
    16. Check Enable Application Connector Instance at next publish.
    17. Click Next.
    18. Click Save.
    19. Publish the changes to make them active.
  4. In VIP Manager complete the third party IdP section under Account > Single Sign-on.
    1. Click Edit next to IDP Service Settings.
    2. Set the Entity ID as the IdP Entity ID configured in the Override IdP Entity ID section of the application connector settings in SAM.
    3. Upload the VIP certificate that was previously downloaded in PEM format.
    4. Click Submit.
Powered by Wolken Software