Entra ID SAML Integration

This guide provides steps to configure Security Assertion Markup Language (SAML) single sign-on (SSO) with Microsoft Entra ID to authenticate internal users to CPAM.

This guide applies to system administrators who implement and maintain identity federation between Microsoft Entra ID and CPAM.

IMPORTANT:

SSO is available only for internal users.

After successful SAML authentication, CPAM receives signed user details (user ID, email, name) to create or update the user record and complete login. Passwords are not managed by CPAM when SAML is enabled.

BEST PRACTICE:

Microsoft Entra ID periodically rolls over its SAML signing key. When the key rotates, you must reupload the SAML certificate in System Admin > Settings > SAML Settings to avoid login failures. Coordinate with your identity team to monitor key rotation events.

Requirements

The Entra ID integration requires system admins to have the following:

  • Administrator access to the CPAM server.

  • Administrator access to Microsoft Entra ID.

  • Matching identifiers across system

    • user ID must match in both systems.

    • email must match and be unique in CPAM.
      If you enable group synchronization, group names in Entra ID must exactly match the user group names in CPAM.

IMPORTANT:

For live environments that currently use local or AD/LDAP authentication, plan a maintenance window and coordinate a joint working session between your identity team and Imprivata support resources. During migration, direct users to authenticate with the legacy option until SAML is fully validated. If needed, you can quickly disable SAML to revert to the prior method.

NOTE:

After a user first authenticates with SAML, they can no longer authenticate with their previous CPAM password. Two-factor settings in CPAM do not apply when Entra ID performs authentication. Use Entra ID MFA if required. IP checks and disabled-account checks still apply.

Workflow Overview

This integration requires exchanging metadata between two systems. Complete the steps in the order, as each step produces something the next step requires.

  1. Get SP metadata from CPAM

  2. Create the Entra ID application (using the SP metadata)

  3. Configure SAML in CPAM

  4. Verify SSO

From a browser, download the SP metadata for CPAM and provide it to your Entra ID app configuration. Replace the host with your system URL:

https://example.org/rss-servlet/metadataxml.action

The CPAM server exposes SP metadata at a static URL. You do not need to configure anything first, the URL is available at any time.

From a browser, navigate to the following URL (replace example.org with your server's hostname):

https://example.org/rss-servlet/metadataxml.action

Download or save this file.

The SP metadata contains two values that Entra ID requires:

  • Identifier (Entity ID): The unique identifier for CPAM as a service provider.

  • Reply URL (ACS URL): The endpoint where Entra ID sends the SAML response after authentication.

Create the enterprise application in Entra ID and provide it with the SP metadata collected in Step 1.

Create the Application

  1. Navigate to Enterprise applications in Entra ID.
  2. Select New application.
  3. Select a Non-gallery application and provide a name.
  4. Choose the Web platform.
  5. Select the SAML 2.0 protocol.
  6. Add users or groups to the application from Users and groups.

Configure SAML Settings

  1. Open Single sign-on > SAML.
  2. Either upload the downloaded SP metadata file from CPAM or manually copy:
    • Identifier (Entity ID): use the value labeled “Identifier” in the SP metadata.
    • Reply URL (ACS URL): use the value labeled “ACS URL” in the SP metadata.

Map SAML Claims

  1. Map SAML claims as shown in the table below.
    Attribute names are case-sensitive

Attribute Existing Attribute Name New Name(s) Accepted

User ID*

 http://schemas.microsoft.com/ws/2013/11/alternateloginid userid username
Name* http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname http://schemas.xmlsoap.org/claims/CommonName name
Email* http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress email mail
Groups** http://schemas.xmlsoap.org/claims/Group groups usergroups
Phone none phone  
Alternate Phone none altphone alternatephone
Department none department dept
Notes none notes  
Manager none manager  
Roles none none none

* = Required

** = Required for Group sync

Finally remove the namespace for each claim and save your configuration.

Download the Entra ID federation metadata

After saving, download the Federation Metadata XML from the Entra ID application. This file is typically available from the SAML Signing Certificate section or via a link labeled App Federation Metadata URL.

In the Legacy UI, configure SAML in your server with the following steps:

  1. Navigate to System Admin > Settings > SAML Settings.
  2. Select Upload IDP Metadata.xml.
  3. Browse to the Entra ID federation metadata file and upload it.
    Confirm that values import successfully.
  4. Set the following options:
    • Enable SAML Authentication: selected
    • Make SSO the default login option: selected
    • Enable Group Sync if groups are provided: selected (optional)
    • NameID Format: Unspecified
    • Role assigned to created users: Standard User (or as needed)
    • Default User Group assigned when no linked groups found: Public (or as needed)
  5. Submit.

To verify the SSO configuration, follow the steps:

  1. Navigate to the login page for CPAM.
  2. Select Authenticate with Single Sign On.
  3. Enter your SSO credentials.

After login, open Admin > My Account and verify the Authentication Provider is SAML.

NOTE:

If SAML controls group membership, you cannot edit those groups in CPAM, you must manage them directly in Entra ID.

Login Behavior

The expected login behavior may differ for new and existing users:

  • New users: Instruct first-time users to select Authenticate with Single Sign On. The system does not auto-forward unknown users from the traditional login form. Admins can pre-create accounts and mark them as SAML users to enable auto-forwarding.
  • Existing users: When marked as SAML users, typing a username into the traditional form auto-forwards to Entra ID to complete authentication.