SAML Single Sign-On (SSO)

Share

Is this article helpful?

Last updated:

Enable SAML Single Sign-on (SSO) for Centrify

The below steps will allow you to configure single sign-on with Centrify. This will allow you to enable your users to automatically sign-in to KnowBe4 for their security awareness training.

Note: Make sure the email address that your users use to authenticate with SAML is either entered into the Email or Email Aliases field of their User Profile. However, only the email address listed in the Email field will receive training notification emails. For more information about adding information to user profiles, see our User Profile Guide.
  1. In your Centrify Admin Portal, add KnowBe4 as a Web App. To do this, follow steps 1-5 in this article provided by Centrify.
  2. Completion of step 5 will take you to the Settings page of the KnowBe4 web app. Here, you have the option to customize your KnowBe4 web app by adding our logo or providing a description of the application.
  3. Beneath Settings on the left, select Trust. This will take you to the Trust page.
  4. Scroll down to the Service Provider Configuration section and select the Manual Configuration option.
  5. Enter KnowBe4 in the SP Entity ID/Issuer/Audience field.
    • If a unique entity ID was generated for your KnowBe4 account, use the ID shown in your Account Settings.
  6. In your KnowBe4 console, locate your SSO Callback URL.
    1. Log in to your KnowBe4 account.
    2. Click on your email address on the top-right and click Account Settings.
    3. Navigate to the SAML section and expand the SAML Settings tab.
    4. Copy your unique SSO Callback (ACS) URL.
  7. Enter your Callback URL in the Assertion Consumer Service (ACS) URL field and check Same as ACS URL for the Recipient field.
  8. Choose the Assertion option for Sign Response or Assertion and select emailAddress from the NameID Format drop-down menu.
  9. In your KnowBe4 console, locate your SSO Sign-out URL (see step 6).
  10. Enter your Sign out URL in the Single Logout URL field.
  11. Select InternetProtocol from the Authentication Context Class drop-down menu.
  12. Click on the Save button.
  13. Beneath Trust on the left, select Account Mapping. This will take you to the Account Mapping page.
  14. Under the Account Mapping section, select the Directory Service Field option.
  15. Enter mail in the Directory Service field name field.
    Note: For more information about Account Mapping, view this article provided by Centrify.
  16. Click the Save button.
  17. Copy the IDP SSO Target URL and IDP Cert Fingerprint and follow the instructions in this article to complete the setup.

Was this article helpful?

2 out of 2 found this helpful

Can't find what you're looking for?

Contact Support