How To: Let Administrators Sign In to the SecureAuth CIAM Admin Portal With an External Identity Provider

Version Affected: All

 

Overview

This article explains how to let administrators sign in to the SecureAuth CIAM admin portal with an external identity provider (IdP), such as SecureAuth Workforce or Microsoft Entra ID, instead of a SecureAuth password, and how to control which administrator role they receive when they do.

You need the Super Admin tenant role and administrator access to the IdP so that you can register the SecureAuth CIAM admin portal there as a SAML or OIDC application. If Sign-in and SSO is not available under Tenant Settings > Account, administrator management has not been turned on for the tenant, and SecureAuth Support can turn it on.

Configure Admin Portal Sign-In Through an External Identity Provider

1. Sign in to the admin portal as a Super Admin, click the gear icon at the top right for Tenant Settings, click Account, and select Sign-in and SSO.
2. In the External Providers section, add a connection for your IdP, such as SecureAuth Workforce, using the provider's template where one exists, or the generic SAML or OIDC template.
3. Copy the connection's ACS URL and Entity ID for SAML, or its Redirect URL for OIDC, and enter them in the application at your IdP. Use the values exactly as the connection shows them: an IdP that posts to any other address, such as /<tenant>/cloud-api/login, receives a 404 error.
4. Map the IdP's email attribute to the authentication context. Without this mapping, an administrator who signs in through the connection is shown as Profile instead of by name.
5. Open the connection's Provisioning tab.
6. Under Admin portal access role, choose the role that administrators who sign in through this connection receive. The default, Member, gives access only to the workspaces or organizations assigned to each administrator, so a new administrator with nothing assigned sees no workspaces. Super Admin gives full access to the tenant.
7. To allow or deny access by attribute or group membership, click the admin portal access policy link and create a policy.
8. Click Save.
9. Test the sign-in in a private browser window, so that an existing admin portal session does not hide the result.

Administrators who sign in through the connection appear under Tenant Settings > Account, where a Super Admin can assign workspaces or organizations to them. If administrators still receive the previous role after you change the Admin portal access role, select Member, save, then select the role you want and save again.

Special Considerations

• The Admin portal access role applies to every user who signs in through the connection, and only one role can be set for each connection. Choosing Super Admin gives all of those users full access to the tenant unless an admin portal access policy restricts who is allowed in.
• Changes to the Admin workspace can lock every administrator out of the admin portal. For example, the admin portal is a single-page application that exchanges its authorization code without a client secret, so removing the none token authentication method from the Admin workspace makes every administrator sign-in fail with a 401 error after the code is returned. Keep at least one Super Admin who signs in with a SecureAuth password rather than an external IdP, and contact SecureAuth Support if you are locked out.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.