CyberArk Identity
CyberArk Identity
Single sign-on (SAML 2.0)
In the portal, choose CyberArk Identity under Enterprise SSO and Start with CyberArk Identity. Then, in CyberArk Identity:
- In the Identity Administration portal, click Apps, then Add Web Apps, and on the Custom tab click Add next to SAML.
- Enter a Name and Description on the Settings page.
- On the Trust page, under Service Provider Configuration, load our metadata URL — or choose Manual Configuration and enter the SP Entity ID/ Issuer /Audience and Assertion Consumer Service (ACS) URL below.
- Save, then under Identity Provider Configuration click Copy URL for the metadata (or Download Metadata File).
- Configure the attributes on the SAML Response page and assign the people who should sign in.
The values the portal shows
| CyberArk Identity field | Value |
|---|---|
| Metadata (Trust → Service Provider Configuration (URL, then Load)), optional | The portal's SP metadata URL (https://…/sso/saml/…/metadata) |
| SP Entity ID/ Issuer /Audience (Trust → Service Provider Configuration → Manual Configuration) | The portal's entity ID (https://…/sso/saml/…) |
| Assertion Consumer Service (ACS) URL (Trust → Service Provider Configuration → Manual Configuration) | The portal's ACS URL (https://…/sso/saml/…/acs) |
What to bring back
Copy Copy URL — the URL, or the XML — and paste it into the portal's Metadata URL or XML. Prefer the URL.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
CyberArk Identity's own guide: https://docs.cyberark.com/manage/latest/en/content/identity/applications/appscustom/addconfigsaml.htm.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Directory Sync (SCIM)
In the portal, choose CyberArk Identity under Directory sync and Create directory; copy the bearer token now, it is shown once. Then, in CyberArk Identity:
- Open the custom SAML app's Provisioning tab and select "Enable provisioning for this application", in Live Mode.
- Enter the SCIM Service URL below.
- Set Authorization Type to Authorization Header and Header Type to Bearer Token, and paste the token below into Bearer Token.
- Click Verify, then choose the roles to provision.
The values the portal shows
| CyberArk Identity field | Value |
|---|---|
| SCIM Service URL (Provisioning) | The portal's SCIM base URL (https://…/scim/v2) |
| Authorization Type (Provisioning) | Authorization Header |
| Header Type (Provisioning) | Bearer Token |
| Bearer Token (Provisioning) | The bearer token the portal shows once |
CyberArk Identity's own guide: https://docs.cyberark.com/manage/latest/en/content/identity/applications/appscustom/configsaml_adminautoprov.htm.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.
- Directory Sync — the portal's SCIM setup.