LDAP attributes in access policies for SAML web portals

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

After creating a TCP/UDP service for SAML SSO authentication to a web portal and assigning the service to a device, an access policy needs to be configured for users imported from LDAP to allow access to the web portal. How does the LDAP attribute assignment work in the SAML part of the policy?

Environment

CA Privileged Access Manager (PAM) integrated with LDAP for user management and SAML authentication to web portals.

Resolution

When the LDAP user logs into the GUI, PAM will check if the user has any SAML web portal policies and determine which attributes are needed for the assertion. It will then resolve those attributes in an LDAP query and store it in the user's session information. When the user launches the web portal, PAM will get the information from the user's session information and set the value of the requested attribute in the SAML assertion to the value of the configured LDAP attribute.

When configuring the policy, select LDAP Attribute from the Attribute column. In the Value column, put the attribute exactly as it is in LDAP. For example, use sAMAccountName, userPrincipalName, etc.

In the example below the SAML identity provider (IdP) requires attribute Subject Name Identifier, and the PAM policy is configured to set its value to the user's LDAP attribute sAMAccountName.