topic Re: Could use some help with Azure SSO for community edition Cortex XSOAR in Cortex XSOAR Discussions

Could use some help with Azure SSO for community edition Cortex XSOAR

DriveYourAceOff — Tue, 26 Apr 2022 20:59:59 GMT

Hello,

I have tried many settings and can't seem to quite figure out what text is to be entered into the setup section within Xsoar for the Azure SAML SSO setup. I keep getting this error:

" {"id":"errSAMLLogin","status":400,"title":"Failed to login via SAML","detail":"Failed to login via SAML","error":"","encrypted":false,"multires":null} "

I have tried many different names and mappings to Azure. Any insight as to what the entry should look like on the Xsoar side would be greatly appreciated.

This is what I have currently made my entries in Azure to be, and have used the claim name in Xsoar and am still getting the error.

Thank you,

Richard

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

jfernandes1 — Wed, 27 Apr 2022 01:36:41 GMT

Hi Richard,

Your claim details don't look right for Azure. They should look like this.

Take a look at this documentation - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/users-and-roles/authenticate-users-with-saml-20/microsoft-azure-as-the-identity-provider-using-saml-20/set-up-microsoft-azure-to-authenticate-cortex-xsoar

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

DriveYourAceOff — Wed, 27 Apr 2022 15:10:18 GMT

Thank you very much for the reply, I have never removed the schema before and have tried it both ways. I have re-added the schema back and still get the same error. I think what I am in need of is what the entry should look like on xsoar side of things. I got the removal of the schema line by looking at the example above in the link that you gave me.

Here is a screen shot of my saml response with the schemas being sent to xsoar:

Any other ideas would be greatly welcomed.

Richard

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

cstone — Wed, 27 Apr 2022 16:25:20 GMT

can you share a screenshot of your integration settings as well please

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

DriveYourAceOff — Wed, 27 Apr 2022 16:59:55 GMT

My current settings:

If you want to see all of the settings, please let me know. I can take additional screen shots.

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

cstone — Wed, 27 Apr 2022 17:07:28 GMT

Yes please

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

DriveYourAceOff — Wed, 27 Apr 2022 17:22:53 GMT

Thank you again for assisting.

Richard

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

jfernandes1 — Thu, 28 Apr 2022 05:02:00 GMT

Hi @DriveYourAceOff, it should looks like this.

Also the last option should look like this. According to the documentation -

"In the Service Identifier (ADFS) field, copy the characters after the appid value, which can be found at the end of the App Federation Metadata URL (section 3 in SAML Certificate)."

Let me know if this works for your.

Thanks, Jeremy.

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

DriveYourAceOff — Thu, 28 Apr 2022 12:43:08 GMT

Is there any way that you can tell me what the fields say at the end of the attributes you used.

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

DriveYourAceOff — Thu, 28 Apr 2022 20:12:30 GMT

Thanks again, I am still getting the same error however. Here are my new settings, and I believe that they are correct. I am thinking that I may start fresh and try again, but here are my newest settings:

I se the appid section and copied that value to put in below:

The only field in question is the group field. I feel like that may be wrong as there are several different ways to make the group throughout the instructions. I have used the below method, and it does look like it is getting the correct group from Azure in the saml response xml.

Thanks again for the help!

Richard

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

jfernandes1 — Fri, 29 Apr 2022 03:35:02 GMT

Hi Richard,

I'm not sure about the iDP Metadata URL. You can copy then from the below

Attribute to get group should be set in a similar way.

Thanks, Jeremy

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

Hartmann — Fri, 29 Apr 2022 07:19:08 GMT

In Cortex XSOAR, go to Settings > Integrations > Credentials and create a new credentials set.In the Username parameter, enter your registered app Application D.In the Password parameter, enter the secret value you created.Copy your tenant ID for the integration configuration usage.

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

DriveYourAceOff — Mon, 02 May 2022 15:03:33 GMT

I updated the group to include the namespace, but am still getting the same error.

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

DriveYourAceOff — Mon, 02 May 2022 15:04:44 GMT

Can you please send me the link to this documentation in xsoar so that I can follow it, this makes sense but I want to make sure that I get the values from the correct places. There is no secret with an Enterprise Application in Azure, so that is where I am getting a little bit lost.

Thanks!

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

jfernandes1 — Wed, 04 May 2022 00:43:06 GMT

Here you go - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/users-and-roles/authenticate-users-with-saml-20/microsoft-azure-as-the-identity-provider-using-saml-20

Re: Could use some help with Azure SSO for community edition Cortex XSOAR

SaiPeddireddy — Fri, 02 Jun 2023 15:53:15 GMT

@DriveYourAceOff How did you able to fix this issue?