Secure IBM Security Verify Privilege Vault with SSO

Most enterprises have become diligent about who is accessing their applications and systems. Do they really need access? Is it temporary or permanent access? What about privileged accounts like root users? It would be a risk to share those credentials with a user or group for an activity with a limited time period. To cater to all of these aspects is where identity and access management (IAM) comes in.

And, this is where IBM Security Verify Privilege Vault can help. IBM Security Verify Privilege Vault helps organizations manage, automate, and track the use of shared privileged identities from a scalable, multitenant cloud platform. It can provide a time-bound elevated access to carry out certain activities with proper justification. Not only that, you can also attach approval workflows, screen recordings, and audits to enhance the security of the privileged accounts.

How do you authenticate to access the console? Instead of authenticating using local credentials, why not centralize the authentication mechanism using Verify SaaS or any IAM platform. This ensures that the users don’t have to remember another set of credentials and are able to use their corporate credentials to access the vault.

Verify Privilege Vault can support both OpenID Connect protocol (OIDC) and Security Assertion Markup Language (SAML) for authentication. This tutorial explains how you can set up SAML with IBM Security Verify SaaS or Microsoft Entra ID.

Component technologies

This use case has a mix of technologies including IBM Security Verify Privilege Vault, and IBM Security Verify SaaS/Entra ID. However, it can be extended to any IAM solution that supports SAML or OIDC for authentication.

IBM Security Verify Privilege

IBM Security Verify Privilege is an IBM privileged access management (PAM) solution that is designed to address privileged account use cases. The privilege portfolio encompasses Privilege Vault, Privilege Manager, Server Suite, and DevOps Vault. Security Verify Privilege Vault offers comprehensive PAM capabilities aimed at safeguarding your organization's most critical assets from cyberattacks and insider threats.

Available in both on-premises and cloud deployments, IBM Security Verify Privilege Vault facilitates the discovery, management, protection, and auditing of privileged accounts across your organization. Privileged users can access credentials locally or within the organization's internal network. PAM solutions ensure privileged accounts' accessibility from any location.

IBM Security Verify Privilege Vault provides centralized, policy-based controls to enable remote workers to securely access privileged accounts, whether in the cloud or on-premises. The solution provides stringent security practices while enabling remote access to privileged accounts.

IBM Security Verify SaaS

The IBM Security Verify SaaS platform is a completely cloud-based IAM solution that offers hybrid cloud deployment options. It provides automated, cloud-based and on-premises capabilities for administering identity governance, managing workforce and consumer identity and access, and controlling privileged accounts.

Verify SaaS offers:

• Core identity base capabilities for both your workforce and consumers, including adaptive access and advanced authentication capabilities that are powered by IBM Security Trusteer's AI-enabled engine
• Single sign-on for centralized access control to cloud and on-premises resources
• Adaptive access for risk-based authentication
• Advanced authentication for frictionless access
• Embedded privacy and consent management capabilities that are prebuilt into easy-to-adopt workflows
• Full lifecycle management to connect application access with business governance workflows

There are new features being added regularly to the product. To keep up to date with the latest capabilities, bookmark What’s new.

SAML

Security Assertion Markup Language is an XML-based open standard for transferring identity data between two parties: the identity provider (IdP) and the service provider (SP). It is an authentication protocol that enterprises use to allow access to their applications.

The IdP performs authentication and constructs a user identity token (called a SAML assertion), signs it, and, optionally, encrypts it, then transmits it to the SP. This token contains user attributes (like email or family name) and, optionally, an authorization level.

The SP requests the validation of the user identity and trusts the IdP and is able to cryptographically verify the user identity token.

In this tutorial, IBM Security Verify Privilege Vault is the SP and IBM Security Verify SaaS is the IdP. User identity is validated by the IdP and sent as response to the SP.

Architecture

The following figure shows the high-level architecture of the developed solution. In this scenario, you access the application (Privilege Vault) protected with Verify policies through a trusted device. The policy ensures that untrusted devices cannot access the application despite successful authentication. Verify supports SAML, OIDC, and legacy authentication protocols.

Prerequisites

To follow this tutorial, you need:

• A Verify SaaS instance. Sign up for a 90-day trial instance.
• An Entra ID or any IAM platform that supports SAML SSO.
• IBM Security Verify Privilege Vault. Register for a 30-day free instance or use the on-prem setup.

Estimated time

It should take you approximately 20 minutes to complete the tutorial.

Steps

Step 1. Set up IBM Security Verify Privilege Vault

1. Log in to IBM Security Privilege Vault as an administrator and navigate to Administration -> Configuration -> SAML.

2. Enable the SAML setting.

   

3. Generate the SP SAML certificate by running the following powershell script. Note the password because you need to provide it later on during configuration.

    # This simply generates a self-signed certificate which will import into Secret Server
    # Requires .NET 4.5 or above
    # Please Run As Administrator
   
    ### User Variables ###
    # Filename of PFX
    $filename = 'secretserver.PFX'
   
    # Certificate Password for PFX
    $pass = Read-Host -Prompt "Enter Password" -AsSecureString
    # DNS name in certificate
    $dnsname = Read-Host -Prompt "Enter FQDN"
   
    ###--Commands--###
    # NOTE: The provider must be set in order to be compatible with .NET 4.5 newer versions of .NET can import certs from more providers
    try {
        $cert = New-SelfSignedCertificate -CertStoreLocation cert:\localmachine\my -DnsName $dnsname -HashAlgorithm SHA256 -KeyLength 4096 -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider"
        $path = 'cert:\localmachine\my\' + $cert.thumbprint
        Export-PfxCertificate -Cert $path -FilePath $filename -Password $pass
        # remove from cert store
        Remove-Item $path
    }
    catch { Write-Error $_ }
   

   This generates a certificate secretserver at the same location from where the script was executed.

4. Navigate to the SAML SP settings, and upload the certificate that you generated earlier.

   

5. Download the SP metadata. It is used later.

6. Navigate to the Identity Providers, and provide the IdP details.

   

7. Click Import IdP from XML Metadata.

   IdP metadata is located at:

   • https://<tenanturl>/v1.0/saml/federations/saml20ip/metadata for Verify SaaS
   • https://login.microsoftonline.com/<tenantid>/federationmetadata/2007-06/federationmetadata.xml?appid=<appid> for Entra ID

Step 2. Add IBM Security Verify SaaS

1. Log in to IBM Security Verify SaaS as an administrator, and navigate to Applications.

2. Click Add application.

   

3. Select Custom application when prompted for Type.

4. Provide the application name and company name.
5. Navigate to the Sign-on tab and select SAML. Upload the SP metadata file that you downloaded earlier.
6. Check the details after the file is uploaded successfully.
7. Click Save.

Note: For the Entra ID, select the galley app Secret Server (On-Premises), and provide the details of the SP.

When the configurations on both sides is successful, you are redirected to the respective IdP configured (if only one IdP exists). If there is more than one IDP configured, you can choose the provider that you want to authenticate against.

If you want to bypass the IdP and locally authenticate to the Vault console, add a query param preventautologin=true in the URL.

Also ensure that the user who is trying to access the console through the IdP already exists in the vault users. If the user does not exist, create the user identity by providing a dummy password.

Summary

In this tutorial, you learned how to integrate an IAM solution (Verify SaaS/EntraID) with IBM Security Privilege Vault. If you’d like to learn about more IBM security applications, see the Security hub on IBM Developer.