Views:

  1. Under "auth", add the following values for "saml enabled" and "location": 
    	auth:
  <other entries>
  saml:
    enabled: true
    location: <Smart Check FQDN or IP>
  2. Update your Smart Check to use updated configuration: 
    	helm upgrade \
  --values overrides.yaml \
  deepsecurity-smartcheck \
  https://github.com/deep-security/smartcheck-helm/archive/master.tar.gz
     
    • Add parameter -n if you are using different namespace.
    • Change master.tar.gz if you are using a specific version of Smart Check.
     

  1. In the Azure console navigate to Enterprise Application > + New Application.

    Module state

  2. Click +Create your own application, add a name then click Create.
  3. Assign Users and Groups by clicking Users and groups on the left, then click Add user/group. Select the user or group you wish to assign to your application.

    Module state

  1. Get the metadata XML on https://[smartcheck fqdn]/saml.

    Module state

  2. Upload the metadata XML to your Enterprise Application single sign-on settings in Azure.

    Module state

  1. On a Linux machine, modify and run the following shell script to get a session token: 
    #!/bin/bash
  
#Create a session, change the target URL to your DSSC
curl -k https://<Smart Check FQDN or IP>/api/sessions --header "Content-Type: application/json" --request POST --data '{
"user": {
"userID": "<user>",
"password": "<password>"
}
}' | jq -r '.token'  > session.json
     
    • Change <user> and <password> to your Smart Check administrator user and password.
    • Change <Smart Check FQDN or IP>.
     
  2. Make sure that session.json file is created with token content.
  3. Go to Azure web console and get the metadata URL.

    Module state

  4. Modify and run the following script to register Azure SSO metadata URL: 
    #!/bin/bash
#Change target URL and metadataURL
 
curl -kv -X POST https://<Smart Check FQDN or IP>:<port>/api/identity-providers/saml -H "Authorization: Bearer $(cat session.json)" -H 'Content-Type: application/json' -d '{
  "name": "IdentityProvider",
  "description": "My SAML identity provider. Contact identity@example.com for support.",
  "metadataURL": "<Metadata URL>",
  "insecureSkipVerify": true
}'
     
    • You can change the description.
    • Change <Smart Check FQDN or IP>.
    • Change <Metadata URL>.
     
  5. Verify that API call was successful: 
    curl -kv -X GET \
  https://<Smart Check FQDN or IP>/api/identity-providers/saml \
  -H "Authorization: Bearer $(cat session.json)"

    You should see the correct metadata URL reflected with "status": "ok".

  1. On Azure SSO, click Edit on Claims.

    Module state

  2. Add a new claim with name RoleSessionName, namespace https://deepsecurity.trendmicro.com/SAML/Attributes and source attribute user.mail.

    Module state

  3. Add another claim with name Role, namespace https://deepsecurity.trendmicro.com/SAML/Attributes and source attribute administrator.

    Module state

    You should be able to log in to Smart Check console using Azure SSO.

    Module state

Keywords: integrate azure ad, azure ad integration deep security, smart check integration with azure ad