Configure SAML

Configure Mobile Access Management to use SAML to provision and authenticate users against your Identity Provider, such as Microsoft Entra ID.

Depending on your organization, MAM takes the role of a Service Provider (SP) and you provide a system to serve as Identity Provider (IdP). No credentials are exchanged during the setup process. Instead, a trusted relationship is established between the services.

This authentication works to the MAM console and to the Launchpad app.

SAML keeps passwords internal to your network, making MAM more secure. SAML also leverages single sign-on, providing a better login experience for users.

The IdP is used only for user authentication. Authorization — assigning users to MAM roles — is still handled within the MAM console.

When a user launches MAM from their IdP, for example myapps.microsoft.com (Microsoft Entra ID), then the user will be generated at that time in MAM with the default role defined in the Admin settings.

  • There is only one default role for accounts automatically created this way, but a user’s role can be modified manually after the user is created.

  • To manually add new individual users and assign them to a specific role, go to the Team page.

  • When a user has no assigned role, they will see an error when attempting to log in with SAML.

NOTE:

MAM (as the SP) and your Identity Provider (the IdP) need metadata from each other.

Open both consoles at the same time and import the metadata.

The metadata can be provided as an XML file, a metadata URL, and specifying the metadata values manually.

  1. In the MAM console, go to Admin > SAML.

  2. Switch the SAML Single Sign-on (SSO) setting to ON. The Configure SAML Single Sign-on dialog opens.

  3. In the Identity Provider Display Name box, type a user-friendly display name for your Identity Provider (IdP).

    1. In the Provide Mobile Access Management Metadata XML to your Identity Provider section, copy the file to your workstation.

  4. In your IdP's admin console:

    1. Export the IdP's metadata XML file to your workstation.

    2. Upload the MAM metadata file saved from step 3.

      Alternately, enter the MAM URL and metadata values manually and save the configuration.

    3. If required, copy the IdP's metadata URL and/or metadata XML contents for use in MAM.

  5. In the dialog, upload the IdP metadata XML or paste the metadata URL or XML contents:

    • To upload the metadata XML file exported from the IdP, click Upload XML file and browse to the location. Click Upload. The metadata XML file is uploaded to MAM.

    • To use a metadata URL from the IdP, click Paste Metadata URL and paste the URL.

    • To use the contents of the XML from the IdP, click Paste XML contents and paste the contents of the IdP's metadata XML.

  6. Click Save.

In the MAM console, configure additional SAML settings:

  1. To set up automatic user creation, where new users are automatically assigned a role, switch the Auto-create user after SAML authentication to ON.

    1. Select the default role to be assigned to the automatically created users.

  2. To require SAML for the MAM console, switch the Require SAML for Mobile Access Management admin console to ON.

    SAML can be mandatory for the MAM console or you can allow traditional usernames and passwords alongside SAML.

    During testing, customers typically keep SAML optional during testing, then switch to required for production use.

  3. In the Default role for auto-created users list, select the default role to assign to the users that are automatically created.

    • This role is only assigned at this organization level.

    • You can modify the role at any time.

  4. To require SAML for MAM Launchpads, switch the Require SAML for Launchpads to ON.

    Many customers continue using username/password for Launchpads, even when the MAM console uses SAML, because Launchpads configured for SAML prompt for user/password every time the app launches. This interrupts automatic start. On the other hand, Launchpad configured without SAML downloads a token and launch without a prompt.

  1. In the Maximum authentication lifetime (in hours) box, type a value between 1 and 168 to specify the amount of time (in hours) users have before they must reauthenticate.

    Imprivata recommends a setting of less than 72 hours.

Organizations can use the default MAM SAML certificate. To make refreshing this certificate easier, you can set an organization-specific certificate.

IMPORTANT:

If this is changed, the Identity Provider (IdP) must refresh the MAM metadata XML file immediately.

Create a Certificate

Creating a certificate generates a new service provider automatically; by default it will be inactive. You must copy the MAM metadata XML into your Identity Provider (IdP) before activating the new certificate.

Activating a new certificate deactivates the currently active certificate. Only one certificate may be active at a time.

  1. In the MAM console, click Create Certificate.

  2. In the Active column, click Active for the certificate you wish to activate. The Make Certificate Active? dialog opens.

  3. Click the URL to copy the MAM metadata XML for use in your IdP before activating the new certificate.

  4. In your IdP admin console, update the MAM metadata XML and save.

  5. In the MAM console, click Make Active to activate the certificate.

Delete a Certificate

In the SAML Certificate list, click the delete icon next to an inactive certificate and confirm the deletion.

Certificate Expiration

Beginning 60 days before the SAML certificate expires, the MAM console displays an alert warning of the expiration. The banner is only displayed when the active SAML certificate is expiring.

MAM handles new user creation differently for SAML-enabled organizations. The differences are visible on the Team page.

  • The Reset Password button is hidden, since passwords are managed by your IdP.

  • The system does not send an email to the new user. You are responsible for notifying new users with instructions on how to log into their MAM account.

  • You can specify a default role to be assigned to new users added to the organization. This role is only assigned at this organization level in your parent/child organization tree.