Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Prerequisite configuration: UCA, FIDO, and Passwordless Windows Logon

Setting up SAE

search

Please Note:

Setting up SAE

Configuring the IdP (for example, SafeNet Access Exchange) requires:

  1. Creating a client
  2. Generating a private key and selecting the credentials type for the client
  3. Configuring the client

Tip

Steps 1 and 3 can be completed faster by importing a pre-configured JSON file with a few modifications, instead of using the SAE UI. See Alternative: Configuring SAE using JSON import. Step 2 must always be completed manually using the SAE UI.

Creating a client

Perform the following steps to create a client in SafeNet Access Exchange (SAE):

  1. Log in to SAE as an administrator.

  2. On the administrator console, select your realm (for example, SAS).

  3. In the left pane, under Manage, click Clients, and in the right pane, click Create client.

  4. Under Create Client, perform the following steps:

    1. Under General Settings, perform the following steps:

      1. In the Client type field, select OpenID Connect.

      2. In the Client ID field, enter a client ID, which is a unique identifier for your application (for example, PCE_WLA). It is an alpha-numeric string that is used to identify the client in OpenID Connect (OIDC) requests. You can create this ID manually or use a naming convention that aligns with your organization's requirements.

      3. (Optional) In the Name field, enter a name of your choice (for example, Windows_Logon).

      4. Click Next.

    2. Under Capability config, perform the following steps:

      1. Enable the Client authentication toggle button.

      2. Under Authentication flow, select the Standard flow, Direct access grants, and Service accounts roles checkbox.

      3. Click Next.

    3. Under Login settings, perform the following steps:

      1. In the Valid redirect URIs field, enter "*" as the Windows Logon instance URL.

      2. Click Save to complete the client configuration.

Generating a private key and selecting the credentials type for the client

Under the client that you have created earlier, for example, PCE_WLA, perform the following steps:

  1. On the Keys tab, click Generate new keys to generate a private key for the client.

    1. Under Generate keys?, perform the following steps:

      1. In the Archive format field, select PKCS12.

      2. In the Key alias field, ensure that client ID is present (for example, PCE_WLA).

      3. In the Key password field, enter a value as per your preferred configuration.

      4. In the Store password field, enter a value as per your preferred configuration.

      5. Click Generate. The keystore.p12 file will be downloaded on your local machine, which contains the private key.

  2. On the Credentials tab, perform the following steps:

    1. From the Client Authenticator dropdown, select Signed Jwt.

    2. Click Save.

  3. On an Ubuntu machine, run the following command to extract the RSA private key from the keystore.p12 file:

    bash openssl pkcs12 -in keystore.p12 -nodes -nocerts | openssl rsa -out OUTFILE.key

Configuring the client

Additional steps for UCA:

  1. In SAE, navigate to your Client > ClientScopes. Click on the -dedicated option.

  2. Configure the following claims and audience. To add a hardcoded claim or audience, click Add Mapper, select the By Configuration option, and then choose either Hardcoded Claim or Audience.

  3. Configure the claims and audience as follows:

    1. Token Type Hardcoded Claim

    2. FAS Audience

    3. Tenant Hardcoded Claim

  4. Assign the FIDO roles to the client to enable FIDO authentication. In SAE, navigate to Client > Roles, and perform the following steps to add the four required FIDO roles one by one:

    1. Click Create role.

    2. In the Role name field, enter the role name and click Save. Repeat this step for each of the following roles:

      • fido2_server-assertion_result
      • fido2_server-authenticators_list
      • fido2_server-authenticator_get
      • fido2_server-assertion_options

    3. Click Save.

Alternative: Configuring SAE using JSON import

As an alternative to the manual UI steps in Creating a client and Configuring the client, you can import a pre-configured JSON file into SAE and make a few modifications. This approach is faster when setting up multiple environments or repeating the configuration.

Note

Step 2 — Generating a private key and selecting the credentials type for the client — must always be completed manually using the SAE UI. The JSON import does not cover key generation.

Step 1: Update the JSON file

Before importing, open the provided SAE_Configuration.json file present in the package in a text editor and replace the following placeholders with your actual values everywhere they appear in the file:

Placeholder Field Description Example
<application_name> Client ID The unique identifier for your client. This placeholder appears in the clientId, roles, users, and serviceAccountClientId fields. Replace all occurrences with your chosen client ID. PCE_WLA
<application_friendly_name> Friendly name The display name for the client. This placeholder appears in the client name field. Replace all occurrences with your chosen display name. Windows_Logon
<application_description> Description A brief description of the client. This placeholder appears in the client description field. Replace all occurrences with a meaningful description. SAS PCE Windows Logon Agent

Caution

Search the entire JSON file for <application_name>, <application_friendly_name>, and <application_description>, and replace every occurrence with your actual values. The <application_name> placeholder appears in multiple locations throughout the file, including client roles, service account configuration, and the client definition. Leaving any placeholder unchanged will cause the import to fail or produce an incorrect configuration.

Step 2: Import the JSON file into SAE

Perform the following steps to import the updated JSON file:

  1. Log in to SAE as an administrator and select your realm.

  2. In the left pane, under Manage, click Realm roles.

  3. Click default-realm-roles.

  4. Click Action > Partial import.

  5. Click Browse, select the updated PCE_WLA_client.json file, and click Import.

On this page