Integrating IBM Cloud Pak with IBM Security Verify

Complete the following steps to download the SAML metadata file:

1. Get the foundational services route to retrieve your IBM Cloud Pak login URL.

   oc get route -n <your-foundational-services-namespace>
   

2. Log in to your IBM Cloud Pak console as an admin user.

3. Click Identity providers > New connection.

4. Select SAML 2.0.

5. Click Download metadata on the New SAML connection page.

Complete the following steps in the IBM Security Verify portal:

1. Create your own IBM Security Verify application. Complete the following steps:

   1. Log in to the IBM Security Verify portal.
   2. From the menu, select Applications.
   3. Click Add application.
   4. Select Custom Application.

2. Set up SSO in the IBM Security Verify portal. Complete the following steps:

   1. Give a name to the application and fill the required sections in the General tab.

      

   2. Click Sign-on tab and select SAML2.0 in the Sign-on method.

   3. Select Use metadata checkbox.

   4. Click Upload Metadata file and Select the SAML metadata file that you downloaded in the Retrieving the SAML metadata file from your IBM Cloud Pak section.

   5. Fill the following details for the SAML configuration.

1. Download the IdP federation metadata from the Third party SaaS application SAML2.0 single sign-on (SSO) configuration section.

3. Click Save.

Complete the following steps from your IBM Cloud Pak console:

1. Log in to your console as an admin user.

2. Click Identity providers.

3. Click the SAML connection that you created in Retrieving the SAML metadata file from your IBM Cloud Pak section.

4. Click Token attribute mapping.

5. Update the token attribute-mapping fields from the IBM Security Verify Federation metadata XML file that you downloaded in the Set up SSO section.

   The following is the Default Token Attribute Mapping:

   "sub": "userID",
   "given_name": "given_name",
   "family_name": "family_name",
   "groups": "groupIds",
   "email": "email"
   

6. For SCIM compliant SAML, enter the following details in the required fields:

   • Scim base path: https://bedrock-iam.verify.ibm.com/v2.0/
   • Grant type: client_credentials
   • Token URL: https://bedrock-iam.verify.ibm.com/v1.0/endpoint/default/token
   • Client ID: Enter the client ID of the IBM Security Verify
   • Client Secret: Enter the client secret of the IBM Security Verify
   Note: The values of the Scim base path and Token URL parameters are based on the IBM Security Verify account.

   The following is the default SCIM attribute mapping for the SAML connection of IBM Security Verify:

      "scim_attribute_mappings": {
             "user": {
                       "name": {
                               "formatted": "name.formatted",
                               "givenName": "name.givenName",
                               "familyName": "name.familyName"
                       },
                       "emails": [
                               {
                                       "type": "work",
                                       "value": "emails"
                               }
                       ],
                       "userName": "userName",
                       "externalId": "id",
                       "principalName": "userName"
             },
             "group": {
                     "id": "displayName",
                     "externalId": "id",
                     "displayName": "displayName",
                     "principalName": "displayName"
             }
      }
   }
   

   The following is the sample payload for IBM Security Verify registration as SAML IdP:

   {
       "name": "SCIM-ISV",
       "description": "ISV bedrock test ISV",
       "protocol": "saml",
       "type": "isv",
       "idp_config": {
           "idp_metadata": "<base64-encoded-metadata>",
           "token_attribute_mappings": {
               "sub": "userID",
               "subject": "userID",
               "given_name": "given_name",
               "family_name": "family_name",
               "groups": "groupIds",
               "email": "email"
           }
       },
        "jit": false,
       "scim_config": {
           "scim_base_path": "https://bedrock-iam.verify.ibm.com/v2.0/",
           "grant_type": "client_credentials",
           "token_url": "https://bedrock-iam.verify.ibm.com/v1.0/endpoint/default/token",
           "client_id": "Your_isv_client_id"",
           "client_secret": "Your_isv_client_secret",
           "scim_attribute_mappings": {
                 "user": {
                           "name": {
                                   "formatted": "name.formatted",
                                   "givenName": "name.givenName",
                                   "familyName": "name.familyName"
                           },
                           "emails": [
                                   {
                                           "type": "work",
                                           "value": "emails"
                                   }
                           ],
                           "userName": "userName",
                           "externalId": "id",
                           "principalName": "userName"
                 },
                 "group": {
                         "id": "displayName",
                         "externalId": "id",
                         "displayName": "displayName",
                         "principalName": "displayName"
                 }
            }
   }
   }
   

7. Click Save.

To test the SAML login after you configure IBM Cloud Pak with IBM Security Verify, complete the following steps:

1. To get your IBM Cloud Pak console URL, run the following command:

   oc get route -n <your-foundational-services-namespace>
   

2. Copy the URL and paste it into your browser.

3. On the login screen, select Enterprise SAML. Use your IBM Security Verify user email to log in to the IBM Cloud Pak.

   To grant an admin role, see Grant an admin role.