Integrate with Windows Server 2016 & 2012r2 Active Directory Federation Services (ADFS) via SAML 2.0 federation
Many organizations use SAML to authenticate users for web services. Prisma Cloud supports the SAML 2.0 federation protocol for access to the Prisma Cloud Console. When SAML support is enabled, users can log into Console with their federated credentials. This article provides detailed steps for federating your Prisma Cloud Console with your Active Directory Federation Service (ADFS) Identity Provider (IdP).
Prisma Cloud supports SAML 2.0 federation with Windows Server 2016 and Windows Server 2012r2 Active Directory Federation Services via the SAML protocol. The federation flow works as follows:
- Users browse to Prisma Cloud Console.
- Their browsers are redirected to the ADFS SAML 2.0 endpoint.
- Users authenticate either with Windows Integrated Authentication or Forms Based Authentication. Multi-factor authentication can be enforced at this step.
- An ADFS SAML token is returned to Prisma Cloud Console.
- Prisma Cloud Console validates the SAML token’s signature and associates the user to their Prisma Cloud account via user identity mapping or group membership.
Prisma Cloud Console is integrated with ADFS as a federated SAML Relying Party Trust.
The Relying Party trust workflows may differ slightly between Windows Server 2016 and Windows Server 2012r2 ADFS, but the concepts are the same.
Configure Active Directory Federation Services
This guide assumes you have already deployed Active Directory Federation Services, and Active Directory is the claims provider for the service.
- Log onto your Active Directory Federation Services server.
- Go toServer Manager > Tools > AD FS Managementto start the ADFS snap-in.
- Go toAD FS > Service > Certificatesand click on thePrimary Token-signingcertificate.
- Select the Details tab, and clickCopy to File….
- Save the certificate as a Base-64 encoded X.509 (.CER) file. You will upload this certificate into the Prisma Cloud console in a later step.
- Go toAD FS > Relying Party Trusts.
- ClickAdd Relying Party Trustfrom theActionsmenu.