How to Configure SAML 2.0 for CyberArk Password Vault Web Access

Contents

• Supported Features
• URL Variables
• Configuration Steps
  • For versions 11.2 and below
  • For versions 11.3 and above
• Notes

---

Supported Features

The Okta/CyberArk Password Vault Web Access SAML integration currently supports the following features:

• SP-initiated SSO

For more information on the listed features, visit the Okta Glossary.

---

URL Variables

You will need the following variables throughout the configuration steps:

• IdentityProviderLoginURL, BaseUrl, SingleSignOnServiceUrl:

  Sign into the Okta Admin Dashboard to generate this variable.

• IdentityProviderCertificate, Certificate:

  Sign into the Okta Admin Dashboard to generate this variable.

• PartnerIdentityProvider Name:

  Sign into the Okta Admin Dashboard to generate this variable.

• LogoffUrl:

  Sign into the Okta Admin Dashboard to generate this variable.

---

Configuration Steps

For versions 11.2 and below

1. Open the c:\inetpub\wwwroot\PasswordVault\web.config file from the server hosting the CyberArk Password Vault Web Access (PVWA).

2. Search for the <appSettings> section.

3. Add the following lines:

   • <add key="IdentityProviderLoginURL" value="<value1>" />

     For <value1>: Use the IdentityProviderLoginURL value provided in URL Variables above.

   • <add key="IdentityProviderCertificate" value="<value2>" />

     For <value2>: Use the IdentityProviderLoginURL value provided in URL Variables above.

   • <add key="Issuer" value="PasswordVault" />

     Note: The value of the Issuer must be identical to the Audience defined in the IdP. The default value for this parameter is PasswordVault.

   

4. Save the web.config file.

5. Restart Internet Information Services (IIS).

6. Login to CyberArk PVWA as an administrator.

7. Navigate to Administration > Options > Access Restrictions.

8. Add a new AllowedReferrer: Use BaseUrl value from URL Variables above.

9. Click Apply.



10. Select Authentication Methods > saml.

11. Display Name: Enter Login with Okta.

12. Enabled: Set to Yes.

13. LogoffUrl: Use the LogoffUrl value from URL Variables above.

14. Click Apply.

15. Click OK.



16. In Okta select the Sign On tab for the CyberArk Password Vault Web Access SAML app, then click Edit:

    • Audience URI: Enter your Issuer.

    • Click Save:

17. Done!

---

For versions 11.3 and above

Note: If you are already working with SAML authentication, and you are upgrading to 11.3, we recommend that you upgrade to the 11.3 configuration file:

• Open the saml.config file located in the installation folder (the default location is \Inetpub\wwwroot\PasswordVault), and configure the PartnerIdentityProvider Name. The rest of the parameters are configured during the upgrade process.

• Only for versions 11.3-11.5: Open the web.config file located in the installation folder, and in the appSettings tag, set the UseNewSAMLSolution parameter to Yes.

1. Follow this guide. Use the values of LogoffUrl, BaseUrl, SingleSignOnServiceUrl, Certificate, and PartnerIdentityProvider Name values from URL Variables above.

2. In Okta select the Sign On tab for the CyberArk Password Vault Web Access SAML app, then click Edit:

   • Audience URI: Enter your ServiceProvider Name

   • Click Save.

3. Done!

---

Notes

Make sure that you entered the correct value in the Base URL field under the General tab in Okta. Using the wrong value will prevent you from authenticating via SAML to CyberArk Password Vault Web Access.

SP-initiated SSO

1. Open your CyberArk PVWA Login URL: [yourBaseUrl]/PasswordVault/.

2. • For V9:

     • Click the back arrow:

       

     • Click Login with Okta:

       

   • For V10+:

     • Click Change authentication method:

       

     • Click LOGIN WITH OKTA: