You can also migrate the custom authentication settings for the following external IDPs. For instructions, click your IDP:
- Entra (SAML)
- Okta (SAML)
- OneLogin (SAML)
- Custom (SAML) You can select this option to migrate your external IDP if your IDP is not available in the authenticator drop-down list.
You can configure the authenticator using one of the following two methods. BlackBerry recommends that you use the secure method to set up the authenticator for Cylance Endpoint Security. You can configure using the easy method first and switch to the secure method later. However, if you change the configuration method and you have configured your authenticator to require users to validate their email with a one-time code, users will need to validate again the next time that they sign in after the change.
- Easy: This configuration method uses the email address for both identifiers (Federated ID and email address) and is the same configuration that is used by the Legacy method. In this method, the email address is used as an identifier, but has some risk because the email address can be changed for a user, which can cause the authentication to fail.
- Secure: This configuration method provides enhanced security and more options to secure users’ sign in to the management console. This method requires additional time to set up and uses two values to identify users:
Federated ID: The Federated ID is a unique value that is used to link the user in PingOne and the Cylance console.
Email address: The Email address ensures the correct user is signing in to the management console. It is obtained from the “email” claim in the SAML response.
Important: The PingOne IDP configuration and the Cylance Endpoint Security authenticator configuration must match the claim names to allow the management console to retrieve the users’ credentials. If they do not match, users cannot sign in to the management console.
The following tasks walk you through the Easy configuration method.
1. Configure PingOne to communicate with Cylance Endpoint Security.
Note: PingOne does not support SSO URLs and the existing SAML application cannot be updated for the custom authentication integration. In your PingOne administration console, you must create a new app with the new single sign-on URL for Cylance. https://idp.blackberry.com/_/resume
By default, the Cylance management console requires all SAML responses to include the user’s email addresses. Important: The email addresses in PingOne must match the addresses that are registered in the Cylance management console.
In the image, the numbers correspond to the step number in the procedure; not all steps are represented in the image.
1. In the PingOne administration console, add a new SAML application. Complete the following steps:
a. In the PingOne Administration console, click Applications.
b. Click the Add Application dropdown and select New SAML Application.
c. Type a name and description for the SAML application.
d. In the Category dropdown, select a category.
e. Click Continue to Next Step.
2. In Application Configuration section, click I have the SAML configuration (see image to the left).
3. In the Protocol version, select SAML v2.0 (see image to the left).
4. In the Assertion Consumer Service (ACS) field, enter https://idp.blackberry.com/_/resume (see image to the left).
5. In the Entity ID field, specify a string to identify the application (for example pingone.example.com). The value can be any string. Make sure it is unique and persistent to avoid any issues if your organization changes topologies or service providers. This value will be used in the management console for the SP Entity ID in the authenticator configuration in the next step. If the Entity ID and SP Entity ID do not match, the authentication request fails (see image to the left).
6. In the Application URL field, enter https://idp.blackberry.com/_/resume (see image to the left).
7. Click Continue to Next Step.
8. Configure the SSO Attribute Mapping. Complete the following steps.
a. Click Add new attribute.
b. In the Application Attribute field, enter email.
c. In the Identity Bridge Attribute or Literal Value field, select Email (Work).
d. Click Continue to Next Step.
9. On the Group Access screen, click Continue to Next Step.
10. On the Review setup screen, complete the following tasks:
a. Download a copy of the signing certificate. Click Download beside Signing Certificate. In an editor, open the file and copy the body of the signing certificate including the Begin Certificate and End Certificate lines. When you copy the body of the certificate, make sure that you don't alter any line breaks or the format of the certificate information. This is used as the IDP signing certificate in the Cylance management console.
b. Download a copy of the SAML Metadata. Click Download beside SAML Metadata. Open the XML file and record the SingleSignOnService Location URL value. This is used as the Login request URL in the Cylance management console.
11. Click Finish.
2. In the Cylance console, update the Migrated Custom Authentication Connector: PingOne - Configuration Required.
- Sign in the to Cylance console.
- On the menu bar, click Settings > Authentication.
- Open Migrated Custom Authentication Connector: PingOne - Configuration Required.
- In the Login request URL field, enter the PingOne single sign-on URL that you recorded in step 1, 10b (see the image to the left).
- In the IDP signing certificate field, paste the body of the signing certificate that you copied in step 1, 10a. When you paste the body of the certificate, make sure that you don't alter any line breaks or the format of the certificate information (see image to the left).
- In the SP Entity ID field, verify that the value matches the value you recorded in the Entity ID field in the PingOne console. If it does not match, change the SP Entity ID field in the Cylance console to match the Entity ID field in PingOne (see the image to the left).
- (Optional) Change the Name of this Authenticator in the Cylance console. The name can be anything you deem appropriate. BlackBerry recommends that you at least remove the “Configuration Required” text from the name (see image to the left).
3. Create an authentication policy and assign it to users and groups.
Create a policy that includes the required authenticators for your environment. You can create a user policy or add the authenticator to the default authentication policies for the console, CylancePROTECT Mobile app or CylanceGATEWAY agent. Assign the policy to one administrator to verify the sign-in policy is functioning as expected. You can then assign the authentication policy to your users.
In the image, the numbers correspond to the Step number in the procedure; not all steps are represented in the image.
1. On the menu bar, click Settings > User Policy.
2. Click the Authentication tab.
3. Click Add Policy.
4. Enter a name and description for the policy (for example, Console Authentication Policy).
5. In the Authenticator rules section, click Add Authenticator. In the Add authenticator dialog box, select the “Migrated Custom Authentication Connector: PingOne - Configuration Required” authenticator or find the name to which you changed the Authenticator in the last step (see image to the left).
6. Click Save.
7. To create the authentication policy, click Save.
8. Assign the policy to one administrator and then verify the sign in is working as expected. Complete the following steps:
a. In the Assign the authentication policy dialog box, click Yes.
b. Click Add User or Group.
c. Start typing a name to search for the user that you want to add.
d. Select the user from the search results.
e. Click Add.
f. Log out of the console, or open an In Private window and access the Console log in page
g. Enter the email address of the administrator to which you assigned the authentication policy above and click Sign In.
h. When prompted, enter your credentials from PingOne.
i. Complete the sign in with your PingOne credentials and verify that the administrator can successfully sign in to the Cylance console.
For more information on additional authentication policy settings, see Create an authentication policy.
Important: Make sure that the Allow Password Login check box (Settings > Application > Custom Authentication) is selected. This option allows you to log in to the console directly and use SSO. If this option is not enabled before you test your SSO settings, users cannot sign in to the console using SSO. For more information on managing authentication policies, see Manage authentication polices for your tenant.
Optionally, it is recommended that you create a user policy (User policy > Authentication) that requires only a Cylance console password and assign it to one or more designated administrators. You should use a strong password for the user policy. You can use this policy as a failsafe while you migrate PingOne to an authenticator.
That's it!
You have successfully configured an PingOne SAML authenticator based on the existing custom authentication and assigned the authentication policy to users and groups.
Users can now sign in to the Cylance console using their PingOne credentials from the sign-in page.
Next steps: Disable Custom Authentication.
After you have verified that you can sign in to the Cylance console from the primary login page using your PingOne credentials, you can go to Settings > Application and clear the Custom Authentication check box.
Sign out and sign in to the Cylance console from the sign-in page using the administrator account with the new authentication policy that was applied in step 3 of this workflow and your PingOne credentials.
Warning: Make sure that you sign in to the Cylance console from the primary sign-in page using you external IDP credentials. If you test the sign in from the “Or sign in with your External Identity Provider” page and then Disable Custom Authentication, you may become locked out of the console.
BlackBerry recommends you secure the Administrator account that you created with the password-only policy by assigning the PingOne policy or changing the password-only policy to add an OTP code for better security.
BlackBerry recommends that you use the secure method to set up the authenticator for Cylance Endpoint Security. For more information about migration your custom authentication settings to an authenticator using the secure method, see the BlackBerry UES Setup Guide.