HYPR

Log in to the Secure Remote Access administration web page with an administrative username and password. Follow the Secure Remote Access instructions for setting it up as a SAML service provider.

ℹ️

Note

The HYPR metadata information is available at this link: https:///auth/realms//protocol/saml/descriptor.

⚠️

Important

Third-party documentation is subject to change. Updates might not be reflected in BeyondTrust documentation. For the most up-to-date information, visit https://www.hypr.com/support or https://www.keycloak.org.

Create a new group policy

1. In the left navigation menu, click Users & Security.
2. Click the Group Policies tab at the top right of the page.
3. Click the Add button.
4. Name the policy. This example uses SAML_auth.
5. Configure access permissions.
   • Scroll down to the Access Permissions pane in Privileged Remote Access or the Representative Permissions pane in Remote Support.
   • Check the box under the Defined column. This reveals a new option, Allowed to access endpoints for PRA or Allowed to provide remote support for RS.
   • Check Allowed to access endpoints (PRA), or select Full Support from the dropdown (RS).
6. In this same pane, scroll down to Jump Technology and select all the options.
7. For Jump Item Roles, select Start Sessions Only for all items (Default, Personal, Teams, System).
8. Configure session permissions.
   1. Scroll down to the Session Permissions pane in Privileged Remote Access. In Remote Support, both Attended Session Permissions and Unattended Session Permissions must be configured.
   2. Check the box next to Session Policy under the Defined column; this reveals additional settings.
   3. Check the box for Allow Elevated Access to Tools and Special Actions on the Endpoint.
9. Scroll down to the Memberships pane and check the box under the Defined column for Add Team Membership (PRA) or Add Support Team Membership (RS).
10. Search for your team, select a team role, and click the Add button to add the team.
11. In the same Memberships pane, scroll down and find Add Jump Group Memberships; check the box under the Defined column.
    1. Search for your Jump Group.
    2. Set the Jump Item Role to Start Sessions Only.
    3. Set the Jump Policy to Set on Jump Items (PRA).
    4. Click Add.
12. At the top left of the page, click Save.

ℹ️

Note

Account Settings, General Permissions, and Availability Settings do not require any changes from the default configuration.

Create a new security provider

1. In the left navigation menu, click Users & Security.
2. Click the Security Providers tab at the top of the page.
3. Click the Add button and select SAML2 for Privileged Remote Access or SAML For Representatives for Remote Support.
4. This page contains five expandable sections, the first four of which you will configure.
5. Expand the Identity Provider Settings pane.
   1. Click Upload Identity Provider Metadata.
   2. Select the SAML metadata file provided by HYPR.
6. Expand the Service Provider Settings pane.
   1. Click Download Service Provider Metadata.
   2. Provide the downloaded file to HYPR.
7. Expand the User Attribute Settings pane.
8. Set the following values:

9. Expand the Authorization Settings pane.
10. Set the Default Group Policy to the previously created policy; this example uses SAML_auth.
11. Click the Save button when you are finished.

Identity provider configuration (HYPR/Keycloak)

Create a new client by importing the BeyondTrust metadata

1. Log in to the Keycloak admin page and select the BeyondTrust realm in the drop-down.
2. Click Clients in the left navigation menu.
3. Once the Clients page opens, click Import client.
4. Click Browse and select the SAML metadata file exported from Secure Remote Access. The Client ID field will be filled automatically; you can also manually enter a Name. This example uses BeyondTrustRSClient.
5. Click Save when finished.

Configure new client settings

1. Log in to the Keycloak admin page and select the BeyondTrust realm in the drop-down.

2. Click Clients in the left navigation menu. A list of clients populates the main pane.

3. Select the client you just created.

   This example uses https://hypr-rs.beyondtrustcloud.com.

4. A set of tabs displays for the client properties:

   • Settings
   • Keys
   • Credentials
   • Roles
   • Client scopes
   • Sessions
   • Advanced

   The following sections describe each tab and the subsections therein.

General settings

Access settings

Leave all the fields blank except for Valid redirect URIs.

SAML capabilities

Signature and encryption

Login settings

Logout settings

Keys

No configuration changes are needed in this section.

Credentials

No configuration changes are needed in this section.

Roles

No configuration changes are needed in this section.

Client scopes

Attribute mappings must be added here.

1. Click the URL in the Assigned client scope column to open the Mappers dialog.

2. Click Add mapper and complete the User Attribute properties for LastName.

3. Click Save when finished adding LastName.

4. In addition to configuring a mapping for LastName, configure mappings for each of the following:

   • FirstName
   • Email
   • Username

   Each of the mappers follows the same pattern shown in the following table; note the case sensitivity.

5. Additionally, Groups must be configured as a Group list.

Sessions

No configuration changes are needed in this section.

Advanced

Click Save when you are finished making changes.

Log in to Remote Support with HYPR

ℹ️

Note

Make sure to install the HYPR Mobile App on your mobile device before proceeding.

1. Open the SAML Kickoff URL: https://.beyondtrustcloud.com/login
2. Launch the Secure Remote Access login.
3. Under the Username and Password fields, click Use SAML Authentication.
4. Enter your username in the HYPR login page, then click Sign In.
5. Complete the login using your HYPR Mobile App.
6. You will receive a push notification on the HYPR Mobile App. Click Login. The HYPR Mobile App will verify your identity (with FaceID, TouchID, etc.); follow its prompts to complete ID verification on the mobile device.
7. You are now logged into Secure Remote Access.