CyberArk - SSO Configuration
This application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk.
This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for CyberArk using Multi-Pass. SSO simplifies user authentication by allowing access to multiple applications with a single set of credentials. This integration enhances security and improves user experience across your organization.
To set up Multi-Pass with CyberArk, ensure you meet the following requirements:
- CyberArk admin rights
- MPAS Admin rights
- Make sure that all users intended to use SSO in CyberArk are registered in your IdP and have the necessary permissions to access CyberArk.
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.
- CyberArk admin rights
- MPAS Admin rights
- Make sure that all users intended to use SSO in CyberArk are registered in your IdP and have the necessary permissions to access CyberArk.
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment.
CyberArk - SSO Configuration
Step 1 - Obtain Tenant XML Metadata from Multi-Pass (IdP)
- Open Multi-Pass Dashboard
- Select the correct tenant and go to Integrations, click on Applications.
- Select SAML in the custom integration section.
- Select Download under Tenant XML Data and save the file locally.
Step 2 - Configure Multi-Pass as the Identity Provider (IdP)
- Open Multi-Pass Dashboard
- Select the correct tenant and go to Integrations → Applications.
- Select SAML under custom integrations.
- Confirm or complete the remaining fields based on the table below:
| Field | Value |
|---|---|
| Client ID (=SP Entity ID) | https://<CYBERARK_TENANT_ID>.id-cyberark.com/ |
| Name | cyberark |
| Description | CyberArk SSO integration |
| Assertion Consumer Service URL | https://<CYBERARK_TENANT_ID>.id-cyberark.com/SAML20/SP/ACS |
| NameID Policy Format | Email |
- Go to the Advanced Console on left side of your screen
- Click on Client and use the search bar to look for CyberArk
- Make sure all the fields are populated based on the tables below
General settings (Multi-Pass)
| Field | Value |
|---|---|
| Client ID | https://<CYBERARK_TENANT_ID>.id-cyberark.com/ |
| Name | cyberark |
| Description | CyberArk SSO Integration |
| Always display in UI | ON |
Access settings (Multi-Pass)
| Field | Value |
|---|---|
| Home URL (IdP-initiated) | https://ca.auth.kzero.com/realms/<TENANT_NAME>/protocol/saml/clients/<APP_NAME> |
| Valid Redirect URIs (ACS) | https://<CYBERARK_TENANT_ID>.id-cyberark.com/SAML20/SP/ACS |
| IDP-Initiated SSO URL Name | <APP_NAME> |
SAML Capabilities
| Setting | Value |
|---|---|
| Name ID Format | email |
| Force Name ID Format | ON |
| Force POST Binding | ON |
| Include AuthnStatement | ON |
Signature & Encryption
| Setting | Value |
|---|---|
| Sign Documents | OFF |
| Sign Assertions | ON |
- Move to the tab Keys and ensure both parameters are set to OFF.
- Go to the Advanced tab and set the Assertion Consumer Service POST Binding URL to match the Valid Redirect URI:
https://<CYBERARK_TENANT_ID>.id-cyberark.com/SAML20/SP/ACS
Step 3 - Configure CyberArk as the Service Provider (SP)
- Log into the CyberArk Identity Admin Portal as an Administrator.
- Navigate to Settings > Users > External Identity Providers > Add.
- Name the SAML configuration Multi-Pass.
- Navigate to the Settings tab.
- Click Inbound Metadata and select Option 2.
- Upload the XML Metadata file obtained from Step 1.
- Select Required under Map federated user to existing directory user.
- Click Save.