Update the Okta (SAML) Authenticator to enable IDP-initiated access to the Cylance console

1. In the Cylance console, generate a new SSO callback URL.

You can use the copy option to copy your authenticator information and create the new SSO callback URL.

In the image, the numbers correspond to the step number in the procedure; not all steps are represented in the image.

1. Open the Authenticators screen (Settings > Authentication).
2. Click the current Okta SAML authenticator (for example, Enhanced Authentication). 
3. Click the Copy icon in the upper-right hand corner of the screen (See image to the left).
   When you click copy, the existing Authenticator heading changes from “Edit authenticator” to “Copy authenticator”. The SSO callback URL field is removed (see image to the left).
4. Update the name of the copied authenticator (for example, Enhanced Authentication – New SSO callback URL). Click Save.
5. Open the Authenticator that you copied. Record the SSO callback URL (see image to the left). Verify that the SSO URL is in the format https://login.eid.blackberry.com/_/resume/saml20/<hash>. This URL will be added to the Okta portal, Single sign-on field in a later step.  in a later step.

2. Update the Authentication policy with the new SSO callback URL.

Add the updated authenticator to your authentication policy. You can also add the updated authenticator to the default authentication policies for the console, CylancePROTECT Mobile app, or CylanceGATEWAY agent. 

Assign the policy to one administrator to verify the sign-in policy is functioning as expected. Only one policy type can be assigned to a user. You can then assign the authentication policy to your users.

In the image, the numbers correspond to the step number in the procedure; not all steps are represented in the image.

1. On the menu bar, click Settings > User Policy.
2. Click the Authentication tab.
3. Click the policy that you created for the authenticator.
4. In the Authenticator rules section, click Add Authenticator. In the Add authenticator dialog box, select the copied authenticator (Enhanced Authentication – New SSO callback URL) that you created in step 1 (see image to the left).
5. Click Save.
6. Delete the current SAML authenticator from the Authentication rules list.
7. Click Save.
8. Delete the previous Okta authenticator (for example, Enhanced Authentication). 

3. In the Okta console, update the current Single sign-on URL in the application SAML Settings.

Update the current URL in the Single sign-on URL field with the  newly generated SSO callback URL to allow Okta to users to communicate with and access the Cylance console directly from the Okta users’ portal.

1. Open the current SAML application (Applications > Applications).2.      Click the General tab.
2. In the SAML Settings section, click Edit.
3. Click Next.
4. In the Single sign-on URL field, delete the current URL and paste the SSO callback URL that you recorded in step 1. Verify that the SSO URL is in the format of https://login.eid.blackberry.com/_/resume/saml20/<hash> (see image to the left).
5. Click Next.
6. Click Finish.
7. Assign users or groups to an application. When users or groups are assigned to an application, it will appear in the users’ Okta user portal and allow the users to directly access the Cylance console using the assigned application. For more information on how to assign an application, see your Okta documentation.

4. Verify that you can sign-in to the Cylance console.

1. Verify that you can sign out and sign in to the Cylance console. Sign out and sign in to the Cylance console from the sign-in page using the administrator account with the updated authentication policy that was applied in step 2 of this workflow and your Okta credentials.
   
   Warning: Make sure that you sign in to the Cylance console from the primary sign-in page using your Azure credentials. If you test the sign in from the “Or sign in with your External Identity Provider” page and then Disable Custom Authentication, you may become locked out of the console.
   
   
2. Verify that you can sign in to the Cylance console from the application that you assigned in step 3. If you cannot access the console from the application, visit support.blackberry.com/community to read article 114834.  
   

5. That’s it!

You have successfully enabled the IDP-initiated Proxy feature. 

Users can now sign-in to the Cylance console using one of the following methods:

• Cylance console sign in: Go to the Cylance Console Sign-in page and sign in directly using your Okta authentication (see image to the left).
• IDP-initiated sign in: Sign in to your user’s portal and click the application that was assigned in step 3 to Single Sign-in to the Cylance console (see image to the left).