SecureAuth IdP and Arculix integration (IdP Factoring)

Use SecureAuth IdP as the primary IdP

Select this check box as True.

User ID Mapping (Request)

Set it to where you mapped the email Search Attribute like userPrincipalName, in the data store profile properties.

For example, Aux ID 9

User ID Mapping (Response)

Set it to the mapped SAML Consumer response from Arculix, like the samAccountName or Authenticated User ID.

For example, Authenticated User ID

Name

Provide a descriptive name that identifies Arculix as an external identity provider.

For example, IdP-Arculix

SAML Issuer

Enter the SAML Issuer information for your organization on the Arculix side. This is your Arculix base URL followed by /saml.

You can find this in Arculix in the Identity Provider Single Sign-on URL field.

For example, https://sso.arculix.com/<your-organization>/saml

SAML Audience

Provide a descriptive name that identifies Arculix (you can use the same name as the Identity Provider Name, above).

For example, IdP-Arculix

IdP Login URL

Enter the login URL for your organization on the Arculix side. This is your Arculix base URL followed by /saml/idp_factor.

For example, https://sso.arculix.com/<your-organization>/saml/idp_factor

SAML Conditions

Select this check box. This activates the validation of time-based constraints on SAML assertions. It ensures they are only used within their valid time period of the SAML assertion. It checks:

This setting adds another layer of security. It stops the potential misuse of SAML assertions outside their intended time.

IssueInstant Valid Time

Set the number of hours during which the SAML assertion is valid.

Clock Skew

Set the number of minutes that SecureAuth IdP subtracts from the NotBefore SAML condition to account for any time differences between SecureAuth IdP and Arculix.

Signing Certificate

Paste the certificate blob from Arculix.

You can come back to this after you've completed Task D: Arculix SAML configuration as an identity provider (IdP). This is also covered in Task E: Paste Arculix certificate in SecureAuth IdP.

Name

Use the same Identity Provider Name that you set up in SecureAuth IdP in the SAML Consumer section in Task B: Add Arculix as an external identity provider.

This is the name to display for push notifications, in the Admin panel, Application portal, and audit logs.

For example, IdP-Arculix

Type

Set to SAML Service Provider.

Out of Band Methods

Select the allowed authentication methods end users can choose to approve MFA requests.

For example, Arculix Mobile app (push notifications), SMS, security key, and so on.

Message for MFA Requests

(Optional) Type a message displayed to end users when sending an MFA request via push notification, SMS, or email.

Upstream IdP

Select this check box to use SecureAuth IdP for the initial authentication and only use Arculix to handle the multi-factor authentication.

IdP Initiated

Leave this check box cleared.

Issuer or Entity ID

Use the same Identity Provider Name that you set up in SecureAuth IdP in the SAML Consumer section in Task B: Add Arculix as an external identity provider.

For example, IdP-Arculix

Log in URL

Enter the login URL of your SecureAuth IdP server.

For example, https://secureauth.company.com/SecureAuth

The authentication policy in SA IdP has multiple applications attached on the Resources tab. So, you do not need to add a realm number in the URL.

Username Field for Upstream IdP

Set to userPrincipalName.

Assertion Consumer Services (ACS) URL

Leave this field blank.

Algorithm

Set to RSA-SHA256.

Certificate

Open the SecureAuth IdP metadata file you downloaded in Task C: Download SecureAuth IdP metadata, in a text editor like Notepad.

Copy the SecureAuth IdP certificate blob, including the beginning -----BEGIN CERTIFICATE----- and ending -----END CERTIFICATE----- like the following example.

Then, in the Service Provider Certificate field, paste the SecureAuth IdP certificate blob like the following example.