Session Authentication with Security Assertion Markup Language

There are two parts to enable session Multi-Factor Authentication (MFA) with SAML. First you will set up the SAML configuration in the Omnissa Workspace ONE UEM console and then you will configure your Identity Provider (IDP) settings for use with Omnissa Workspace ONE Tunnel.

SAML is the standard for transferring identity data between two parties like an identity provider (IdP) and a server provider (SP) by providing a single point authentication that allows your users to only sign in one time to be able access multiple service providers.

Confirm your Workspace ONE UEM console is version 2302 or later. This ensures that the multi-factor authentication (MFA) settings under the Client Authentication sections are available by default. However, if you are using the Workspace ONE UEM console with version 2212, this feature is behind a feature flag (TunnelMultiFactorAuthenticationFeatureFlag) so be sure to enable it.

From your Workspace ONE UEM console under Client Authentication, follow these steps to setup SAML authentication.

1. In the Client Authentication section, select SAML from the Authentication factor's dropdown menu.

2. Click Configure to upload the IDP metadata. The metadata file type should be XLM.

3. Enter the Application ID as setup on IDP

Workspace ONE Tunnel Profile

The Tunnel profiles for both MDM and Standalone enrollment will show a toggle to enable Multi-Factor Authentication (MFA) but the support will vary based on the platform type. Once the toggle is enabled and the profile is saved, all clients that receive this profile will be enabled for MFA.

Platform Enrollment Support for MFA: Windows and iOS platforms support both MDM and Standalone enrollment. Currently, Android is only supported though MDM enrollment while macOS is only supported though Standalone enrollment.

Device Traffic Rules (DTR) Configuration

Set the following configurations based on your platform type.

For Windows: Per-App Tunnel Mode- No action is required. Full Device Tunnel Mode- If the Default Rule is TUNNEL, add a Rule with Rank 1 to Bypass the IDP-related domains. If the default rule is BYPASS, no additional action is required. Configure other rules per requirement.

For macOS: The macOS client in Standalone mode currently does not support Per-App Tunnel mode. Full Device Tunnel Mode- No action is required.

For iOS: Device Tunnel Mode- No action is required.

For Android: Per-App Tunnel Mode and Full Device Tunnel Mode - No action required.

Optional Custom Settings

Key	Value	Notes
jwt_token_expiry	Minumum: 60 Maximum: 720
mfa_session_timeout	0 - Disabled Minimum=60	This value is time in minutes. Time for which a continuous connection to the Tunnel server will be established before the session is terminated. A new session will be established immediately if further traffic needs to be tunneled and user will be prompted for SAML authentication.

*Non-zero value will enable the MFA session timeout timer.

Identity Provider Configurations

We currently support Workspace ONE Access, OKTA, and Microsoft Azure IDPs. Support for other IDPs is on our roadmap. Here is how to setup your Workspace ONE Access tenant for use with Workspace ONE Tunnel for this feature.

Workspace ONE Access

1. Log in to Workspace ONE Access Admin page.

2. Select Resources.

   1. Select New.

      1. Update the Name & Description.

      2. Upload the tunnel icon if required.

      3. Click Next.

   2. Configuration

      1. Set the authentication type to SAML 2.0 and configuration type to Manual.

      2. Update the Single Sign-On URL to:

         HTTPS://{TunnelserverHostname}:{TunnelServerPortinUEM}/tunnel
         

      3. Update the Recipient URL to:

         HTTPS://{TunnelServerHostname}:{TunnelServerPortinUEM}/tunnel
         

         • TunnelServerHostname is the public FQDN for the tunnel server.

         • This is the same hostname configured with the UEM console for the Tunnel configuration.

      4. Set the Application ID to WS1Tunnel.

         • You may provide a different Application ID.  Please enter the same Application ID while uploading the SAML Metadata within WS1 UEM. 

   3. Access Policies.

      • Select the access policy as desired.

   4. Save and assign the application to the user or user group.

Steps to retrieve the SAML Metadata

• Log in to Workspace ONE Access Admin page.

• Select Resources.

• Select Settings section.

  • Select SAML Metadata under SaaS Apps.

  • Click on copy URL for IDP metadata.

• Save the SAML metadata.

OKTA

The following information is a guideline to set up OKTA IDP for use with Workspace ONE Tunnel for this feature. 

Note:

Please follow the appropriate documentation per your Identity Provider for required setup.

1. Log in to the OKTA Admin page.

2. Select Applications.

   • Go to: Application > Create App Intergration > SAML 2.0.

   • Click Next.

   • Enter the App name.

   • Upload the App logo if required.

   • Select these two options: Do not display application icon to users and Do not display application icon in the OKTA Mobile app.

     • This is not mandatory but a recommended best practice to disable for Tunnel MFA workflow. 

   • Click Next.

   • Update the Single Sign-On URL to:

     HTTPS://{TunnelServerHostname}:65535/tunnel
     

     • TunnelServerHostname is the public FQDN for the Tunnel server.

   • Update the Audience URI (SP Entity ID) to WS1Tunnel.

     • You may provide a different Application ID.  Please enter the same Application ID while uploading the SAML Metadata within WS1 UEM. 

   • Update the Default RelayState to:

     HTTPS://{TunnelServerHostname}:65535/tunnel
     

     • TunnelServerHostname is the public FQDN for the Tunnel server.

   • Keep the Name ID format as unspecified.

   • Choose the Application username based on your requirement (or keep it to the OKTA username).

   • Click Finish.

   • Click on assignment and assign the application to the user or groups.

Steps to retrieve the SAML Metadata

• Log in to the OKTA Admin page.

• Select Applications.

• Select the application created for the Tunnel SAML MFA.

• Select Sign on, scroll down to SAML Signing Certificates, and set:

  • Click on the action drop-down for the active certificate Type ( SHA-1 or SHA-2).

  • Select View IDP metadata.

  • Save the SAML metadata based on the console version.

Microsoft Azure

The following information is a guideline to set up Microsoft Azure IDP for use with Workspace ONE Tunnel for this feature.

Note:

 Please follow the appropriate documentation per your Identity Provider for required setup.

1. Log in to the Azure Admin page.

2. Select Azure Active Directory.

3. Select Enterprise applications.

   • Click New Application.

   • Click Create Your Own Application.

   • Enter a name for your application.

   • Select Integrate any other application you don't find in the gallery (Non-gallery).

   • Click Create.

4. Select Single Sign-on under Manage.

   • Select SAML.

   • Click Edit for Basic SAML Configuration.

   • Add the Identifier (Entity ID) as WS1Tunnel.

     • You may provide a different Application ID.  Please enter the same Application ID while uploading the SAML Metadata within Workspace ONE UEM. 

   • Update the Reply URL (Assertion Consumer Service URL) to HTTPS://{TunnelServerHostname}:65535/tunnel

     • TunnelServerHostname is the public FQDN for the Tunnel server.

   • Add the Sign-on URL and Relay State. to HTTPS://{TunnelServerHostname}:65535/tunnel or leave it blank as it is not mandatory.

     • TunnelServerHostname is the public FQDN for the Tunnel server.

   • Click Save.

5. Select Users and Groups.

   • Assign the application to the user or groups.

Steps to retrieve the SAML Metadata

• Log in to theAzure Admin page.

• Select Azure Active Directory.

• Select Enterprise applications.

• Select Single Sign-on under Manage.

  • Under SAML Certificates.

    • Download the Federation Metadata XML.