CyberArk SAML setup

Enable your CyberArk users to access 1Password SaaS Manager with Single-Sign-On (SSO).

Configuration in CyberArk

Add the Web App

1. Navigate to Apps & Widgets > Web Apps and select Add Web Apps.
2. Select SAML, then select Add.
3. Confirm that you want to add the application.
4. Close the Add Web Apps dialog so that you can edit the new app's settings.

Settings

1. Enter a Name, for example "1Password SaaS Manager".
2. Download the SaaS Manager logo and upload it in the Logo field.
3. Enter an Application ID, for example saas_manager_saml.
4. If you want users to see the tile in the User Portal, make sure Show in user app list is checked. 
5. Select Save and move to the Trust tab.

Trust

1. Under Identity Provider Configuration, select Copy XML in the Metadata section.
2. In a separate browser tab, switch to SaaS Manager, and go to Settings > Users.
3. Under Single Sign-On (SSO) > SAML providers, select the New button to add a new SAML identity provider.
4. Enter a name (CyberArk) and paste in the XML metadata that you copied to the clipboard above.
5. Select Create.
6. Now you will need to paste the SAML Entity ID and SAML Assertion Consumer Service (ACS) URL from SaaS Manager into CyberArk.
7. Paste them in, and select emailAddress as the NameID Format.
8. Select Save and move to the SAML Response tab.

SAML Response

1. You need to add two attributes to map the logged in user's first name and last name. 

   Attribute Name	Attribute Value
   given_name	LoginUser.FirstName
   family_name	LoginUser.LastName

2. Select Save and move to the Permissions tab.

Permissions

Add the relevant users, roles or groups to the Permissions tab. We recommend assigning to a test user before wider deployment.

Make sure the Run and Automatically Deploy checkboxes are selected.

Select Save, and the status should change to Deployed.

Test the connection

From the User Portal, select the 1Password SaaS Manager tile to login.

New users will be provisioned with the role specified under Settings > Users > Default role.