Set Up MS Azure as the Identity Provider Using SAML 2.0 - Administrator Guide - 6.8 - Cortex XSOAR - Cortex - Security Operations

In the Azure Portal, create new groups to match the Cortex XSOAR roles.

For example, Cortex XSOAR comes out of the box with the Administrator, Analyst, and Read-Only roles. We need to add these roles to Azure.

1. From the home page, select Azure Active Directory → Groups → New group.

2. Add the Administrator group.

   You can add existing users to this group now or at a later stage.

   You can also allow Azure AD Group Owners to add or modify users in the group. Groups can be manually or dynamically populated by user or a device (see the options under Membership type) and defer to the Azure Administrator. One option is for Cortex XSOAR to populate the group membership as part of a custom playbook for bulk user provisioning.

3. Click Create.

4. Repeat these steps for each group required. For example, analyst, read-only user, etc. It is recommended, as a minimum, to create a group for each role.

Create a Non-Gallery application.

1. From the home page, select Enterprise applications → New Application.

2. Select Non-gallery application.

3. Type the name of your application and click Add

   The page redirects to the Overview page. Copy the Object ID for future reference.

Assign Groups to the new application.

1. In the Getting Started section, click Assign users and groups.

2. Click Add user/group → Users and groups.

3. Select the groups that you created in step Step 1.

4. Repeat for all other groups created.

Set up SSO configuration for the application.

1. In the Set up single sign on field, click Get started.

2. Click SAML.

3. In the Basic SAML Configuration section, add the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL).

   Use the format https://<XSOAR Server FQDN>/saml

4. To use SP initiated SSO, in the Sign on URL field, add the URL in the format:

   https://<XSOAR Server FDQN>/#/login

   Users can sign into the Cortex XSOAR login page, an authorization request is sent to Azure, and after authentication, the user is logged in to Cortex XSOAR.

5. In the User Attributes & Claims section, click the edit icon and add the following attributes and values as required.

   Ensure the attribute names match the names in Cortex XSOAR, when defining the instance.

6. Add a new group, click Add a group claim.

7. In the Group Claims (Preview) window, select Security groups.

8. In the Advanced options section, select the Customize the name of the group claim and Emit groups as role claims check boxes.

9. Click Save.

10. Copy the additional claims details in text format as these are added when you Configure the SAML 2.0 Integration for Azure.

    If you are setting up an SMS integration (such as Twilio) add a new phone attribute new claim to reference users directory phone numbers.

11. Copy the App Federation Metadata Url, Login URL and Logout URL fields, which are needed to configure the instance in Cortex XSOAR.

(Optional) Add a new certificate.

1. In the SAML Signing Certificate section, click the edit button.

2. Click New Certificate.

3. In the Signing Option field, from the drop down list, select Sign SAML response and assertion.

4. Click Save.

   Ensure the status is active in Section 3.

5. In section 3, download the Certificate (Base 64) for future use.

6. Generate a private key for assertion signing. For example type the following command:

   openssl genrsa -out saml.key 2048

   Save the private key to notepad for later configuration.

You can now add an instance in Cortex XSOAR, as described in Configure the SAML 2.0 Integration for Azure.

Create a SAML 2.0 integration instance.

1. Go to Settings → Integrations → Instances.

2. Search for SAML 2.0 and click Add instance to configure a new integration.

3. Add the metadata/URL parameters from Azure to Cortex XSOAR.

   Cortex XSOAR field	Azure Portal field
   Service Provider Entity ID	Identifier (Entity ID) (Basic SAML Configuration Section)
   IdP metadata URL	App Federation Metadata URL (SAML Signing Certificate Section)
   Idp SSO URL	Login URL (SAML Signing Certificate section)

   The following Azure metadata/URL information has been added to the SAML 2.0 attributes in Cortex XSOAR:

4. In the following fields, copy the Azure attributes exactly how they appear in Azure (in Azure, go to User Attributes & Claims → Edit). For example, in the Attribute to get email field, type http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

   In this example, we have the following Claim Names:

   Cortex XSOAR SAML 2.0 field	Azure Portal Claim Name Examples
   Attribute to get username	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
   Attribute to get email	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   Attribute to get first name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
   Attribute to get last name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
   Attribute to get groups	http://schemas.microsoft.com/ws/2008/06/identity/claims/role

   Add the phone attribute, if required.

5. Select the Verify the Idp response signature and add the Idp Public certificate, which you downloaded in step 5.5 in Configure Microsoft Azure to Authenticate Cortex XSOAR).

   If your Identity Provider requires signed authentication requests, select Sign request and input the public/private certificate pair generated for Cortex XSOAR.

6. Select the ADFS and Compress encode URL (ADFS) checkboxes.

7. In the Service Identifier (ADFS) field, copy the characters after the appid value, which can be found at the end of the App Federation Metadata URL (section 3 in SAML Certificate).

8. In the IdP Single Logout URL, from Azure, copy the Logout URL (section 4).

9. In the Single Logout Service Endpoint add the details in the following format:

   https://<cortex xsoar-url>/saml-logout

10. To verify that the settings are successful, in the instance settings, click Get service provider metadata.

    For a full list and descriptions of the fields, see SAML 2.0 Azure Parameters.

    If you click Test a bug is issued similar to this:

    You need to login with a user to test the instance. It is recommended to test this also on the Azure app, as there are detailed error reports and troubleshooting.

Map the Azure groups to Cortex XSOAR roles.

1. In Microsoft Azure, select Azure Active Directory → Enterprise applications → name of your application → Assign users and groups → Name of your group .

2. Copy the Object ID.

   For example, we created a group, called XSOAR Administrator.

3. In Cortex XSOAR, go to Settings → Users and Roles → Roles.

4. Create or edit an existing role, as described in Define a Role.

5. In the SAML Roles Mapping field, type the Object ID that you copied in step Step 2.b

Click Save.