Update your PingOne (SAML) Authenticator to enable IDP-initiated access to the Cylance console

1. In the Cylance console, generate a new SSO callback URL.

Use the copy option to copy your authenticator information and create the new SSO callback URL.

In the image, the numbers correspond to the step number in the procedure; not all steps are represented in the image.

1. Open the Authenticators screen (Settings > Authentication).
2. Click the current Ping Identity SAML authenticator (for example, Enhanced Authentication). 
3. Click the Copy icon in the upper-right hand corner of the screen (See image to the left). 
   When you click copy, the existing Authenticator heading changes from “Edit authenticator” to “Copy authenticator” and the current SSO callback URL is removed (see image to the left).
4. Update the name of the copied authenticator (for example, Enhanced Authentication – New SSO callback URL). Click Save.
5. Open the updated authenticator. Record the SSO callback URL (see image to the left). Verify that the URL is in the format  https://login.eid.blackberry.com/_/resume/saml20/<hash>.
   This URL will be added to the PingOne console, Reply URL (Assertion Consumer URL) field in a later step.

2. Update the Authentication policy with the new SSO callback URL.

Add the updated authenticator to your authentication policy. You can also add the updated authenticator to the default authentication policies for the console, CylancePROTECT Mobile app, or CylanceGATEWAY agent. 

Assign the policy to one administrator to verify the sign-in policy is functioning as expected. Only one policy type can be assigned to a user. You can then assign the authentication policy to your users.

In the image, the numbers correspond to the step number in the procedure; not all steps are represented in the image.

1. On the menu bar, click Settings > User Policy.
2. Click the Authentication tab.
3. Click the authentication policy that you created for the authenticator.
4. In the Authenticator rules section, click Add Authenticator. In the Add authenticator dialog box, select the copied authenticator (Enhanced Authentication – New SSO callback URL) that was created in step 1 (see image to the left).
5. Click Save.
6. Delete the original SAML authenticator from the Authentication rules list.
7. Click Save.
8. Delete the previous Ping Identity authenticator (for example, Enhanced Authentication). 

3. In the PingOne console, update the current ACS and Application URL in the application SAML settings.

Replace the current ACS and Application URL fields with the newly generated SSO callback URL to allow PingOne users to communicate with and access the Cylance console directly from the PingOne users’ portal.  

1. Open the current SAML application (Applications > SAML).
2. Click Edit.
3. Click Continue to Next Step.
4. In the following fields, delete the current URL and paste the SSO callback URL that you recorded in step 1 (see the image to the left). Verify that the SSO URL is in the format of https://login.eid.blackberry.com/_/resume/saml20/<hash>.
   •  Assertion Consumer Service (ACS)
   •  Application URL
5. Click Continue to Next Step twice.
6. Click Finish.
7. Assign users or groups to an application. When users or groups are assigned to an application, it will appear in the users’ PingOne user portal and allow users to directly access the Cylance console using the assigned application. For more information on how to assign an application, see your PingOne documentation.

4. Step 4 action

1. Verify that you can sign out and sign in to the Cylance console. Sign out and sign in to the Cylance console from the sign-in page using the administrator account with the updated authentication policy that was applied in step 2 and your PingOne credentials. 
   
   Warning: Make sure that you sign in to the Cylance console from the primary sign-in page using your PingOne credentials. If you test the sign in from the “Or sign in with your External Identity Provider” page and then Disable Custom Authentication, you may become locked out of the console.
   
   
2. Verify that you can sign in to the Cylance console from the assigned application that you were assigned in step 3. If you cannot access the console from the application, visit support.blackberry.com/community to read article 114834.

5. That's it!

You have successfully enabled the IDP-initiated Proxy feature. 

Users can now sign-in to the Cylance console using one of the following methods:

• Cylance console sign in: Go to the Cylance Console Sign-in page and sign in directly using your PingOne authentication (see image to the left).
• IDP-initiated sign in: Sign in to your user’s portal and click the application that was assigned in step 3 to Single Sign-in to the Cylance console (see image to the left).