Secret Server: Configuring SAML Single Sign-on

Steps

Administer Configuration SAML Role Permission

The “Administer Configuration SAML” role permission is required to use SAML to access SS. To grant a user this permission from an administrator account:

1. Go to Admin > Roles. The Roles page appears.

2. Click the Create New button. The Role Edit page appears:
   
   

3. Type the name, such as SAML, in the Role Name text box.

4. Click to select the Enabled check box.

5. Click Administer Configuration SAML in the right side Permissions Unassigned list box.

6. Click the < button to move the permission to the other side.

7. Click the Save button. The Roles page returns.

8. Click the Assign Roles button.name link of the newly created role. The View Role Assignment page appears:
   
   

9. Click the Role dropdown list to select the role you just created.
   

10. Click the Edit button. The Role Assignment page appears:
    

11. Move the desired users to the Assigned list using the same method as before.

12. Click the Save Changes button.

Setting up Secret Server

1. Navigate to Admin > Configuration.

2. Click the SAML tab:
   

3. Click the Edit button in the SAML General Settings section.

4. Click to select the SAML Enabled check box.

5. Click the Save button.

6. Under General Settings, click Edit, then check the SAML Enabled checkbox. Save changes.

7. Click the Edit button in the SAML Service Providers section.

8. Type a name for your SS service provider, such as SecretServerServiceProvider, in the Name text box.

9. Click the Select Certificate link. The Upload Certificate popup appears:
   

10. Choose your certificate:

• For on-premises instances: the uploaded certificate should match the one used for Secret Server’s HTTPS configuration, or you can create it as a self-signed certificate using this PowerShell script.
• For Secret Server Cloud users: Generate your own certificate using this PowerShell script.
  
  Note: Run the referenced PowerShell script as an admin on a machine with .NET 4.5 or above, and replace the variables in the script as directed. Your certificate will be created in the directory from which you run the script. The subject name on the certificate is irrelevant, though for on-premises instances it typically will match the URL of the instance.

1. Click the Upload Certificate button.

2. Locate your certificate .pfx file and select it.

3. Click the Open button. The new certificate appears.

4. Type the access password for the private key of the certificate in the Password text box.

5. Click the OK button. The certificate is uploaded and tested, and the popup disappears. The certificate now appears in the SAML Service Provider Settings section.
   
   Note: If you have an outdated version .NET Framework (earlier than 4.6.2), you may see an error recommending you upgrade to fix the error. Reload the certificate after you do so.

6. Click the Save button.

7. Click the Create New Identity Provider link. An Identity Provider popup appears.

8. Click the Import IDP from XML Metadata link.

9. Navigate to your SecretServerSAMLMetadata.xml file and select it. This is used for uploading into your IDP, which varies by provider. Follow instructions in the following section..

10. Click the Open button.