OneWelcome as an external IDP

You can integrate STA with an external identity provider (IDP) to redirect network traffic from STA to the external IDP for user authentication. STA remains the primary IDP while orchestrating with an external or secondary IDP.

Here, OneWelcome is used as an external IDP.

Integrating STA with OneWelcome requires the following steps:

1. Adding STA as a Web Client in OneWelcome

2. Adding OneWelcome as an external identity provider in STA

3. Adding OneWelcome as an authentication method in a STA policy

4. Verify authentication

As a prerequisite, obtain the STA Redirect URI. Perform the following steps:

1. On the STA Management Console, click on the settings icon .

2. Under SETTINGS > AUTHENTICATION, click External Identity Provider , and click Setup.

   

3. On the External Identity Provider window, click Set up new IDP.

4. Under Redirect URI, click Copy to copy the redirect URI, and paste it into a text editor. You will need it while adding STA as a web client in OneWelcome.

   

Adding STA as a Web Client in OneWelcome

Perform the following steps to add STA as a web client in OneWelcome:

1. Log in to the OneWelcome administrator dashboard.

2. Go to the Configuration tab, and then the Web clients tab.

3. Under Web clients, click Add Web client.

   

4. Under Add Web client, in the Name field, enter a name for the application (for example, SafeNet Trusted Access). Do not change values of rest of the fields.

   

5. Under Credentials, perform the following steps:

   1. In the Client ID field, click Generate to generate a unique client ID. Copy the ID and paste it in a text editor. You will need the client ID while adding OneWelcome as an external IDP in STA.

   2. Under Authentication method, select the Client secret (basic authentication) option.

   3. In the Client secret field, click Generate to generate a secret corresponding to the client ID that you generated in step a. Copy the client secret and paste it into the text editor. You will need the client secret while adding OneWelcome as an external IDP in STA.

   

6. Under OAuth settings, perform the following steps:

   1. In the Grant types field, select Authorization code.

   2. Ensure that JSON Web Token (JWT) is selected as Access token format.

   3. In the Redirect URL field, enter the redirect URL that you obtained as a prerequisite.

   4. Enter values in the rest of the fields as per your preferred configuration.

   

7. Scroll down, under Scopes, under Default Scopes, select email, openid, and profile.

   

8. Under User registration, in the Identity provider field, select an IDP as per your choice.

   

9. Do not change values in the rest of the fields.

10. Click Save.

11. On the Configuration tab, go to the System tab, and in the left pane, select JWT Key Configuration.

    

12. In the right pane, under JWT Key Configuration, copy the Discovery URL and paste it in the text editor. You will need it while adding OneWelcome as an external IDP in STA.

Adding OneWelcome as an External Identity Provider in STA

Perform the following steps to add OneWelcome as an external IDP in STA:

1. On the STA Management Console, on the External Identity Provider window, on the top-right side, click Edit.

2. Under Display Names, perform the following steps:

   1. In the IDENTITY PROVIDER NAME field, enter a name for your IDP (for example, OneWelcome).

   2. In the CREDENTIALS NAME field, enter the authentication method that the external IDP uses (for example, Password).

   In policies, such names are used to identify the external IDP in the format, [Identity Provider Name] ([Credentials Name]) (for example, OneWelcome (Password)).

3. Under Server Details, perform the following steps:

   1. In the CLIENT ID field, enter the client identifier that you copied earlier in step 5 (a) of Adding STA as a Web Client in OneWelcome. This is the OIDC application (client) ID that is used to identify OneWelcome.

   2. In the CLIENT SECRET field, enter the shared secret that you copied earlier in step 5 (c) of Adding STA as a Web Client in OneWelcome. STA sends the OIDC shared secret to authenticate the redirection request using OneWelcome.

   3. In the WELL-KNOWN CONFIGURATION ENDPOINT field, enter the Discovery URL of OneWelcome that you copied earlier in step 12 of Adding STA as a Web Client in OneWelcome.

   4. Click Load to populate the Endpoint URLs and the Issuer fields.

4. Under User Mapping, perform the following steps:

   1. In the REQUEST USER IDENTIFIER field, ensure that E-mail address is selected. This is the STA user attribute that is sent in the authentication request to the external IDP.

   2. In the VERIFICATION USER IDENTIFIER field, ensure that the E-mail address is selected. The identifier is generally identical to the request user identifiers. This is the STA user attribute that is used to match with the content of the specified ID token claim.

   3. In the VERIFICATION CLAIM NAME field, enter the name of your claim (for example, email.). This is the claim present in the returned ID token that contains the user identifier to be verified.

   For demonstration purposes in this documentation, E-mail Address is used as a user attribute for user mapping. You can configure user mapping as per your preferred configuration.

5. Under Scope, in the SCOPE VALUE field, enter the scope values as openid, profile and email.

6. Click Save.

   

Adding OneWelcome as an authentication method in a STA policy

The external IDP OneWelcome is now an authentication method that you can add to STA policies and authentication scenarios.

1. On the STA Management console, select the Policies tab.

2. Select the icon to add a new policy or a scenario.

3. Enter a name and a description for the policy.

4. Under Scope, select the users and the applications, on which you want to apply the policy.

5. Under Decision, under Primary authentication requirements, click Change to select the authentication methods as per your preferred configuration.

   

6. If you want to keep OneWelcome as a mandatory authentication method, select External IDP as one of the Primary authentication requirements and select the OneWelcome (Password), which you have added in the above steps.

7. If you want to keep OneWelcome as optional or secondary authentication method, select External IDP as one of the Secondary authentication requirements and select the OneWelcome (Password), which you have added in the above steps.

   It depends on the administrators how they choose to authenticate the organization's employees.

8. Click Save.

   

For more information, refer to the Add a Policy section in the STA Online Documentation.

Verify Authentication

Using the STA console

Navigate to the end application SSO URL.

You will be redirected to your STA sign-in page. Enter your primary directory login information, approve the two-factor authentication, and you should be redirected to the OneWelcome sign-in page. Enter your OneWelcome login credentials and you should be redirected to the application dashboard.

Using the STA user portal

Navigate to the user portal URL to log in to the STA user portal dashboard. On the dashboard, you will see a list of applications to which you have access. Click on the end application icon, you should be redirected to the OneWelcome sign-in page. Enter your OneWelcome login credentials and you should be redirected to the application dashboard.

Appendix: OneWelcome as an Identity Broker

Identity Brokers allow Service Providers to offer a selection of Identity Providers (authentication methods) to their customers via a single integration. An Identity Broker is an intermediary service that connects Service Providers (SPs) with multiple Identity Providers (IDPs).

Here, OneWelcome functions as an identity broker, redirecting any incoming requests to another IDP based on the configuration. This happens based on the scope parameter. Depending on the scope, OneWelcome decides which identity provider to redirect the authentication request.

This integration enables IDP flow orchestration between STA, OneWelcome ID Broker, and configured third-party IDP. In this external IDP integration, any request coming to STA will be redirected to the OneWelcome ID Broker, and from there, the flow is redirected to another IDP for authentication. Refer to the below workflow:

To configure a third-party IDP within the OneWelcome ID broker, refer to the OneWelcome documentation.