SAML Settings

The SAML configuration enables administrators to configure SAML fo to enable Single Sign On (SSO) option. When administrators use SAML to configure SSO, the configuration immediately changes the authentication methods for the server.

IMPORTANT:

The SAML configuration may change the authentication method at a server-level and the change is immediate. Imprivata recommends that you follow this procedure in a scheduled maintenance session to prevent down-time for your users.

TIP:

Create a local administrator to maintain access to your server in case the configuration locks you out. Remember to contact Imprivata Customer Service if you encounter any problems.

This document contains the requirements and step-by-step guide on how administrators set up SAML to configure SSO.

Requirements

To complete the configuration ensure that you meet the following requirements. If these requirements are not met, the configuration will fail and you risk down-time for your users.

  • Permissions and Access: 

    • You must be an administrator at server-level to access to the SAML configuration page.

    • You must have access to your Identity Provider (IdP) configuration.

  • Authentication Methods: 

    • Your Identity Provider (IdP) must be able to request MFA to your users.

  • Server Version:

    • Your server must be version 23.1.12 or higher. Find your version at the footer of your server's Administrator Console.
      Contact success@imprivata.com to receive assistance in updating your server.

Failing to meet these requirements results in errors during the configuration.

Step-by-Step Guide

The SAML configuration occurs in the following stages:

  1. Download your server's data.

  2. Upload your server's XML to your Identity Provider (IdP).

  3. Configure SSO in your server.

    NOTE:

    Imprivata VPAM now automatically update Azure Entra ID (formerly Azure Active Directory) SAML signing certificates during key rollovers. This automation removes the need for manual certificate updates. The system also supports multiple active certificates to ensure continuous SSO authentication during transitions.

  4. Finalize the configuration.

Each step is its own process and administrators must follow each one properly to secure the configuration.

The default service provider (SP) metadata is an XML file that contains server-level SAML configuration information. Download this file and provide it to your Identity Provider (IdP) administrator before you create a SAML Provider.

  1. Open System Administration in your server.

  2. Open Authentication Providers.

  3. Select the SAML tab.

  4. Click Download Default SP Metadata.

    The download starts automatically.

  5. Wait for the download to complete.

NOTE:

The default SP metadata is not specific to an individual SAML Provider. After you create a SAML Provider, you can download provider-specific SP metadata from the provider view page. The provider-specific metadata is scoped to that provider's entity ID and NameID format.

  1. Open the System Admin tab in your server.

  2. Hover the Settings menu.
    A drop-down list displays.

  3. Select SAML Settings.
    The SAML Settings Page displays.

  4. Click Download SP Metadata.xml at the top of the pane.
    The download starts automatically.

  5. Wait for the download to complete.
    After the download is complete, continue with the next step.

NOTE:

The server's XML file you download contains references that VPAM requires from your Identity Provider (IdP). From this point, Imprivata recommends that you continue with your internal IdP SME.

The process to upload your server's XML file to your IdP changes depending on which IdP you use. Follow your IdP documentation to upload your server's XML and download your IdP Metadata file. Contact your IdP administrator for assistance.

Your IdP Metadata file must contain the following information, otherwise, the SAML configuration may fail:

  • EntityID

  • Endpoints

    • Single Sign On Service Endpoint

    • Single Logout Service Endpoint

  • Public X.509 Certificate

  • Name ID Format

  • Organization Information

  • Contact Information

To configure SSO, create a named SAML Provider. The SAML Provider contains the IdP metadata, synchronization settings, and advanced SAML settings for that provider.

  1. Open System Administration in your server.

  2. Open Authentication Providers.

  3. Select the SAML tab.

  4. Click Add SAML Provider.

  5. Optional: Import an IdP metadata XML file to pre-fill the fields in the form.

  6. Complete the SAML Provider form.

IMPORTANT:

Ensure that you read the Advanced Settings section in this document to prevent errors when configuring your SAML settings.

Attribute

Description

Name

Defines the SAML Provider name that appears in the SAML Providers table.

Require MFA Validation from IdP for SSO Users

Requires the IdP to include valid secondary authentication SAML metadata when users authenticate with SSO.

Enable Group sync

Assigns new users who sign in with SAML/SSO to a user group based on their assigned group in your IdP.

Enable Role sync

Assigns new users who sign in with SAML/SSO to a user role based on their assigned role in your IdP.

Single sign-on URL

Defines the URL that users access to authenticate with SSO through your IdP.

Single logout URL

Defines the URL that users access to sign out through your IdP.

IdP Signing Certificate

Defines the certificate that the server uses to validate SAML responses from your IdP. This field can be pre-filled when you import an IdP metadata XML file.

Default Role

Defines the user role assigned to users who sign in when no linked roles are found from your IdP.

Default User Group

Defines the user group assigned to users who sign in when no linked groups are found from your IdP.

The Show Advanced SAML Settings section contains additional SAML Provider settings, including NameID format, authentication comparison, authentication context, SP entity ID, excluded role names, key rollover, app federation metadata URL, IdP issuer, and signature algorithm.

To finalize the configuration, return to your SAML Settings Page and Upload your IDP Metadata file. Complete the SAML Settings Page considering the following table.

IMPORTANT:

Ensure that you read the Advanced Settings section in this document to prevent errors when configuring your SAML settings.

Attribute Description
Enable SAML Authentication

Enables your server to configure SAML.
Make SSO the default login option

Enables your users to authenticate with SSO.
Require MFA Validation from IDP for SSO Users

This feature is primarily used for Imprivata to validate MFA has been met for Nexus Connections when the remote user's server is configured with SAML Authentication. Checking this box will prevent users from being able to Log Into their VPAM user during the SSO step if the internal IdP does not contain valid secondary authentication SAML metadata when completing SSO.

Important: When you select this option, you must provide accurate details in the Advanced Settings section to ensure users do not get locked out.
Enable Group Sync if groups are provided Assigns new users that sign in with SAML/SSO to a User Group based on their assigned group in your IdP.
Enable Role Sync if roles are provided Assigns new users that sign in with SAML/SSO to acquire a User Role based on their assigned group in your IdP.
Sign-On URI

Define your server's entrypoint to your IdP.
Logout URI Define your server's logout URI from your IdP.
IDP Signing Certificate Define a credential (token) for your server to your IdP.
This field autocompletes when you upload your IDP Metadata.
Default Role assigned when no linked roles found Define a User Role for users users that sign in, but they don't have a role assigned in your IdP.
Default User Group assigned when no linked groups found Define a User Group for users users that sign in, but they don't have a group assigned in your IdP.

Advanced Settings

Imprivata recommends that you create a locally authenticated system admin user before modifying any settings to prevent being locked out of your VPAM server.

The Advanced Settings section contains the fields in the following list.

  • NameID Format: Define the expected schema (format) when your server's enforces MFA through your IdP.

  • Required authentication level: Define the MFA expected response from the user that attempts to sign in or log in.

  • SAML Auth Context reference: Specify the structure in which your server and your IdP relate a single user's identity and authentication.

  • Entity ID for the server: Provide the name of your server exactly as you provided it for your IdP to grant access to the user database.

  • Excluded Role Names from Role Sync: Provide the types of user roles that do not receive an automatic role when signing in to your server.

When you finish the SAML Provider form:

  1. Click Create SAML Provider.

  2. Confirm that the server redirects to the provider view page and displays a success notification.

  3. Review the provider status.

    New SAML Providers are enabled by default. To disable or re-enable the provider, use the Enable Provider toggle on the provider view page.

  4. Download provider-specific SP metadata, if needed.

    On the provider view page, click Download SP Metadata. The metadata uses the provider's entity ID and NameID format.

To submit the changes to your server, click Submit on the SAML Settings Page.

After your server reloads the page, ensure that your IdP administrator also refreshes your IdP authorizations for previously signed on users. If you do not refresh your authorizations directly on the IdP, the system will lock.