DocumentationAPI ReferenceRelease Notes
Documentation

SAML | PRA

Suggest Edits

Benefits of SAML integration

BeyondTrust Privileged Remote Access integrates with SAML identity providers for secure single sign-on. This enables users to authenticate once and access Privileged Remote Access alongside other enterprise applications.

  • Connect to enterprise SAML providers.
  • Provide seamless single sign-on.
  • Centralize authentication management.

How do I access the Security Providers page?

  1. Use a Chromium-based browser to sign in to your Privileged Remote Access URL.
    This URL is provided in the BeyondTrust welcome email and includes your site URL followed by /login.
  2. From the left menu, click Users & Security.
    The Users page opens and displays by default.
  3. At the top of the page, click Security Providers.
    The Security Providers page displays.

Add a security provider

  1. On the Security providers page, click + Add, and then select SAML2 from the list.
    The Add Security Provider page displays.
  2. Configure the security provider following the steps below.
SAML2 fields

  • Name: Enter a unique name to help identify your provider.

  • Enabled: If checked, your appliance can search this security provider when a user attempts to log in to the access console or /login. If unchecked, this provider will not be searched.

  • User provision: By default, user provisioning occurs on this provider. If you have a SCIM provider set up, you can choose to provision users through that provider instead.

  • Associated email domains: This setting applies only when more than one SAML provider is active. Otherwise, it is ignored.

    Enter the email domains you want to associate with this SAML provider, one per line. During authentication, users enter their email address, and the domain is checked against this list. If it matches, they are redirected to the corresponding identity provider for authentication.

    If multiple SAML providers are configured and the user’s email domain does not match any provider’s associated domains, the user will not be allowed to authenticate.

  • Identity provider settings

    • Metadata: The metadata file contains all the information needed for the initial setup of your SAML provider and must be downloaded from your identity provider. Save the XML file, and then click Upload Identity Provider Metadata to select and upload the selected file.

    • Entity ID: The unique identifier for the identity provider you are using.

    • Server certificate: This certificate will be used to verify the signature of the assertion sent from the identity provider.

      ℹ️

      The fields for Entity ID, Single sign-on service URL, and Certificate are automatically populated from the identity provider's metadata file. If you cannot get a metadata file from your provider, this information can be entered manually. For metadata files with multiple identity providers, enter the Entity ID of the desired Identity Provider in the field below before uploading the metadata.

    • Single sign-on service URL: When you want to log in to BeyondTrust using SAML, this is the URL where you are automatically redirected so you can log in.

    • SSO URL protocol binding: Determines whether a user posts or is redirected to the sign on URL. This should be left defaulted to redirect unless otherwise required by the identity provider. If request signing is enabled (under Service Provider settings), protocol binding is limited to redirect only.

  • Service provider settings

    • Download service provider metadata: Download the BeyondTrust metadata, which must then be uploaded to your identity provider.

    • Entity ID: This is your BeyondTrust URL. It uniquely identifies the service provider.

    • Private key: If necessary, you can decrypt messages sent by the identity provider, if they support and require encryption. Click Choose File to upload the private key necessary to decrypt the messages sent from the identity provider.

    • AuthnRequest signing certificate: This is the certificate used for signing AuthnRequests. The following formats are accepted: .cert, .cer, .crt, .der, .pem, .x-x509-ca-cert, .x-x509-user-cert, .x-pem-file.

    • Signed AuthnRequest: Check to enable request signing. If enabled, SSO URL protocol binding is limited to redirect only. The SSO URL protocol binding field is updated automatically, if necessary. A private key and signing certificate is required for request signing.

  • User attribute settings: SAML attributes are used to provision users within BeyondTrust. The default values match BeyondTrust-certified applications with various identity providers. If you are creating your own SAML connector, you may need to modify the attributes to match what is being sent by your identity provider.

    • Username: The SAML attribute that contains the user’s unique username or login ID.

    • E-mail: The SAML attribute that contains the user’s email address.

    • Use case-insensitive comparison for NameIDs: If your identity provider requires case-insensitivity for the NameID attribute, select this option.

    • Display name: The SAML attribute that contains the user's display name.

  • Authorization settings

    • Lookup groups using this provider: Enabling this feature allows faster provisioning by automatically looking up groups for this user, using Group Lookup Attribute Name and Delimiter. We recommend enabling this feature.

      If not used, SAML users must be manually assigned to group policies after their first successful authentication.

    • Group lookup attribute name: Enter the name of the SAML attribute that contains the names of groups to which users should belong. If the attribute value contains multiple group names, then specify the Delimiter used to separate their names.

      If left blank, SAML users must be manually assigned to group policies after their first successful authentication.

    • Delimiter: If this field is left blank, then the attribute value may contain multiple XML nodes with each one containing a different name.

    • Available groups: This is an optional list of SAML groups always available to be manually assigned to group policies. If left blank, a given SAML group is made available only after the first successful authentication of a user member of such group. Enter one group name per line.

    • Default group policy: Each user who authenticates against an external server must be a member of at least one group policy in order to authenticate to your appliance, logging into either the /login interface or the access console. You can select a default group policy to apply to all users allowed to authenticate against the configured server.
      If a default policy is defined, any allowed user who authenticates against this server might have access at the level of this default policy. Therefore, we recommend you set the default to a policy with minimum privileges to prevent users from gaining permissions you do not wish them to have.

      ℹ️

      If a user is in a default group policy and is then specifically added to another group policy, the settings for the specific policy always take precedence over the settings for the default, even if the specific policy is a lower priority than the default, and even if the default policy's settings are set to disallow override.

  • Test settings: You can test the SAML configuration from this page. The provider must be saved before it can be tested. Click Save at upper left area of the screen, then scroll down and click Test. The configuration is tested against the identity provider, and a test results page shows the SAML response and a formatted version of the assertion XML. The responses can be copied to other tools if further review is required.

✅

See Additional setup and tips to learn how to:

  • Sign in to the access console
  • Sign in to the admin interface
  1. Click Save at the top of the page.

Change priority order of security providers

  1. At the top of the Security providers page, click Change Order.
  2. Drag and drop security providers to set their priority. You can drag and drop servers within a cluster; clusters can be dragged and dropped as a whole.
  3. Click Save Order for prioritization changes to take effect.

Disable a security provider

Disable this security provider connection. This is useful for scheduled maintenance, when you want a server to be offline but not deleted.

  1. On the Security providers page, locate the security provider you want to disable.
  2. Click > Disable.

To re-enable the security provider, click > Enable.

View the log for a security provider

View the status history for a security provider connection.

  1. On the Security providers page, locate the security provider you want to view.
  2. Click > View Log.

Edit a security provider

ℹ️

If you edit the local security provider and select a default policy that does not have administrator permissions, a warning message appears. Ensure other users have administrator permissions before proceeding.

  1. On the Security providers page, locate the security provider you want to edit from the list.
  2. Click .
    The Edit security provider page displays.
  3. Edit the security provider details. The details available are the same as the Add security provider page details.
  4. Click Save at the top of the page.

Delete a security provider

  1. On the Security providers page, locate the security provider you want to delete.
  2. Click to delete the security provider.

Additional setup and tips

SAML: Sign in to the access console

To log into the BeyondTrust access console, select SAML Credentials from the dropdown menu.

If you have not yet logged into your identity provider, you are redirected using the default browser. After logging into the identity provider, the web browser redirects you to access console.

ℹ️

Users can access the mobile access console using SAML for mobile. To learn more, see Log in to the Android access console using SAML for mobile and Log in to the iOS access console using SAML for mobile.

SAML: Sign in to the admin interface

From the /login administrative interface, select Use SAML Authentication.

If you have not yet logged in to your identity provider, you are redirected to their site to enter your credentials.

When you click Sign In you are taken to the /login interface.

ℹ️

If you are already logged into your identity provider, then when you click Use SAML Authentication to log in, you are taken directly to the /login interface.

Updated 15 days ago

©2003-2025 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.