Setting up SAE

Configuring the IdP (for example, SafeNet Access Exchange) requires:

1. Creating a client
2. Generating a private key and selecting the credentials type for the client
3. Configuring the client

Creating a client

Perform the following steps to create a client in SafeNet Access Exchange (SAE):

1. Log in to SAE as an administrator.

2. On the administrator console, select your realm (for example, SAS).

3. In the left pane, under Manage, click Clients, and in the right pane, click Create client.

   

4. Under Create Client, perform the following steps:

   1. Under General Settings, perform the following steps:

      1. In the Client type field, select OpenID Connect.

      2. In the Client ID field, enter a client ID, which is a unique identifier for your application (for example, PCE_WLA). It is an alpha-numeric string that is used to identify the client in OpenID Connect (OIDC) requests. You can create this ID manually or use a naming convention that aligns with your organization's requirements.

      3. (Optional) In the Name field, enter a name of your choice (for example, Windows_Logon).

      4. Click Next.

      

   2. Under Capability config, perform the following steps:

      1. Enable the Client authentication toggle button.

      2. Under Authentication flow, select the Standard flow, Direct access grants, and Service accounts roles checkbox.

      3. Click Next.

      

   3. Under Login settings, perform the following steps:

      1. In the Valid redirect URIs field, enter "*" as the Windows Logon instance URL.

      2. Click Save to complete the client configuration.

      

Generating a private key and selecting the credentials type for the client

Under the client that you have created earlier, for example, PCE_WLA, perform the following steps:

1. On the Keys tab, click Generate new keys to generate a private key for the client.

   

   1. Under Generate keys?, perform the following steps:

      1. In the Archive format field, select PKCS12.

      2. In the Key alias field, ensure that client ID is present (for example, PCE_WLA).

      3. In the Key password field, enter a value as per your preferred configuration.

      4. In the Store password field, enter a value as per your preferred configuration.

      5. Click Generate. The keystore.p12 file will be downloaded on your local machine, which contains the private key.

      

2. On the Credentials tab, perform the following steps:

   1. From the Client Authenticator dropdown, select Signed Jwt.

   2. Click Save.

   

3. On an Ubuntu machine, run the following command to extract the RSA private key from the keystore.p12 file:

   bash openssl pkcs12 -in keystore.p12 -nodes -nocerts | openssl rsa -out OUTFILE.key

Configuring the client

Additional steps for UCA:

1. In SAE, navigate to your Client > ClientScopes. Click on the -dedicated option.

   

2. Configure the following claims and audience. To add a hardcoded claim or audience, click Add Mapper, select the By Configuration option, and then choose either Hardcoded Claim or Audience.

3. Configure the claims and audience as follows:

   1. Token Type Hardcoded Claim

      

   2. FAS Audience

      

   3. Tenant Hardcoded Claim

      

4. Assign the FIDO roles to the client to enable FIDO authentication. In SAE, navigate to Client > Roles, and perform the following steps to add the four required FIDO roles one by one:

   1. Click Create role.

      

   2. In the Role name field, enter the role name and click Save. Repeat this step for each of the following roles:

      • fido2_server-assertion_result
      • fido2_server-authenticators_list
      • fido2_server-authenticator_get
      • fido2_server-assertion_options

   3. Click Save.