home

Security Service Edge

Mobile Endpoint SecuritySecurity Service Edge
Mobile Endpoint SecuritySecurity Service Edge

Lookout Product Documentation

Find answers about using and optimizing Lookout products.

Show Contents

Security Service Edge

Configure Single Sign-On (SSO)

Update SP and IdP Settings to Point to Secure Cloud Access IdP Proxy

This step is required to enable SSO logins to flow through the Secure Cloud Access IdP proxy.

  1. Download the metadata files for the Secure Cloud Access IdP proxy.
    Download links for the metadata files are listed for the default group in the SSO Groups page. Click the icon to download the files.

    For IdPs providing the same entity Id for all applications, such as Azure, ADFS, SAP IAS, STA, use the following configurations.

    • Use the Default SSO Group metadata for Enterprise Authentication, which includes Management SSO, Decryption Client, and Proxy Authentication.

    • Create a new SSO Group per each cloud and use this metadata for configuring the cloud SSO. When the IdP used is ADFS, download the metadata from ADFS.

      Import the metadata to the Management Console. Select Administration > Enterprise Integration > Single Sign-On and click the SSO Provider tab. Choose Identity Provider as the Type.

      When the IdP used is Azure, perform the following steps to configure the same SAML signing certificate and modify the downloaded metadata for each application.

    1. Sign in to the Azure Active Directory portal ( https://aad.portal.azure.com).
    2. In the left pane, select Enterprise applications. A list of the enterprise applications in your account appears.
    3. Select the desired application. An overview page for the application appears.
    4. In the left pane of the application overview page, select Single sign-on.
    5. If the Select a single sign-on method page appears, select SAML.
    6. In the Set up Single Sign-On with SAML - Preview page, find the SAML Signing Certificate heading and select the Edit icon. The SAML Signing Certificate page appears, which displays the status (Active or Inactive), expiration date, and thumbprint (a hash string) of each certificate.
    7. Select Import Certificate. Upload a certificate with a private key and pfx credentials. Enter the PFX Password and select Add.
    8. Make the newly uploaded certificate active and delete the other certificate(s).
    9. Click Save.
    10. Download the Federation Metadata XML file.

      Import the metadata to the Management Console. Select Administration > Enterprise Integration > Single Sign-On and click the SSO Provider tab. Choose Identity Provider as the Type.

  2. Select the Identity Proxy Routing tab.
  3. Using the downloaded metadata files, update the SSO setting of your cloud SP so that it points to the Secure Cloud Access IdP proxy instead of to your enterprise IdP.
  4. The Secure Cloud Access IdP proxy supports both SP and IdP-initiated SSO flows.
    SP-initiated SSO for multiple cloud applications is supported by creating only one entity in your enterprise IdP. However, with a single-entity setup, an IdP-initiated SSO flow will not work. To enable both SP and IdP-initiated SSO flows to work, you must create one entity/cloud service provider in your enterprise IdP. To do so, perform either of the following steps:
    • If you need to support only SP-initiated SSO flow, use the metadata you downloaded to create an entity with a generic name (such as Secure Cloud Access IdP Proxy) to represent all cloud service providers in your enterprise that need SSO.
    • If you need to support both SP and IdP-initiated SSO flows, perform the following steps for each cloud service provider.
    1. Using the metadata file you downloaded, create an entity with a name that indicates which cloud service provider this entity is -- for example, Cloud1 CASB IdP Proxy.
    2. Go to the SSO provider you had created in the Secure Cloud Access Management Console for that cloud and obtain the Relay State value.

      For SSO providers that are saved and being used for proxy routing, the label of the Save button at the bottom is changed to indicate that this provider is currently in use for proxy routing. The button is dimmed.

    3. In your enterprise IdP, add the Relay State value in the Default Relay State/Relay State field in the setup of the entity for this cloud service provider.
    4. Using the metadata file you downloaded, update the SSO setting of your enterprise IdP so that it points to the Secure Cloud Access IdP proxy instead of your cloud SP.

      Users can now log in to the enterprise IdP and click the entity corresponding to a cloud service provider to start the IdP-initiated SSO login.

Last updated: September 30, 2024

lookout-footer

Legal Privacy Policy Cookie Policy Transparency Report Compliance Info Compliance Info (Gov)

© 2024 Lookout, Inc. LOOKOUT®, the Lookout Shield Design®, LOOKOUT with Shield Design® and the Lookout multi-color/multi-shaded Wingspan Design® are registered trademarks of Lookout, Inc. in the United States and other countries. DAY OF SHECURITY®, LOOKOUT MOBILE SECURITY®, and POWERED BY LOOKOUT® are registered trademarks of Lookout, Inc. in the United States. Lookout, Inc. maintains common law trademark rights in EVERYTHING IS OK, PROTECTED BY LOOKOUT, CIPHERCLOUD, and the 4 Bar Shield Design.