This article explains how to configure the SAML SSO integration of Passly with CyberQP. 

Prerequisites

• Administrator role for Passly
• Passly configured with the user accounts that will be used for accessing CyberQP..
• Primary or Super Role in CyberQP
• All of your Technicians configured in Login Management in CyberQP will need an account in Passly with exactly the same email address.
  Manual - https://support.getquickpass.com/hc/en-us/articles/360040722434-How-to-Setup-Quickpass-Dashboard-Logins
  Bulk Import - https://support.getquickpass.com/hc/en-us/articles/4411037813783-How-to-Bulk-Import-Quickpass-Dashboard-Logins 
  • Note the Primary and Super Roles will still be able to login with their CyberQP Account username and password to allow access in the case of challenges with the SSO.
• A User Group that you wish to use for sign in to the CyberQP Dashboard should be created and the users you wish to have access should be made members of this group.
  
• Initial configuration steps as per https://support.getquickpass.com/hc/en-us/articles/4419178721559-Setting-up-Dashboard-Logins-for-SSO-SAML-

Instructions

1. Log in to the Passly Portal. In the left-hand menu, click SSO Manager and click Application Library

   

2. Click Add New Application at the bottom of the screen.

   
   
   

3. Select the "Custom Application" by searching or scrolling through the list.  (We are working with Passly to allow you to select a pre configured SSO configuration for CyberQP.  The KB will be updated when this is available)

   
   
   

4. On the Application Configuration tab fill in the Application Name and add a Logo for the Passly Launchpad.  Ensure that the Application is Enabled and the Authentication Policy that your team uses should be selected from the Drop down.
   
   
   

Protocol Setup Tab

1. Fill in the values as follows:
   
   1. Protocol Type:  SAML SP-Init
      
   2. Assertion Consumer Service URL

      NA or Oceania	https://admin.getquickpass.com/api/auth/sso/login/callback
      EU	https://eu-admin.getquickpass.com/api/auth/sso/login/callback

   3. UNCHECK Allow Multiple Audiences
      
   4. Service Entity ID (Issuer)
      This value is found on the CyberQP Dashboard Authentication Options page.  It is listed as "Entity ID" 
      
   5. Identity Issuer
      This value is normally populated directly by Passly.  In testing we found that this value being changed did not work, however you may have some custom configuration within Passly that would require this value to be changed.  We suggest to leave it with the default value.
      1. This value will be populated into the CyberQP Dashboard Authentication Options Issuer URL and SAML Logout Endpoint URL
         
         
   6. Token Lifetime should be left at the default unless you want your team to be prompted more/less often to enter their Passly Credentials during Dashboard logins.
      
      
   7. Advanced Settings drop down
      
      1. Uncheck Include All Audience URIs
      2. Check Sign Token Response
      3. Check Sign Assertion
      4. Set Signing Algorithm to SHA-256
      5. Fixed Relay State
         1. You can leave this blank if you want your team to have to manually sign in to the Passly Portal to access the Dashboard.
         2. You can populate this value with the same information from the Service Entity ID (Issuer) value if you want your team to be automatically logged into the Dashboard when logging in.
            
            
            
      6. The Protocol Setup tab should look like this when completed:
         

Attribute Transformation Tab

1. 1. Select the "Just issue an attribute as the username" radio button
      1. Change the Drop down to (User.EmailAddress)
         
         
         1. NOTE this will change once you save the Passly configuration.  
            
            
            

Permissions Tab

1. 1. Add the Group(s) from your Passly User/Group configuration that will access the CyberQP Dashboard.
      
      

Signing and Encryption Tab

1. 1. Click the <> Copy Button and the Digital Certificate details will be shown.
      
      
      1. Copy this value to your clipboard INCLUDING the initial and trailing " ---" characters.
         
         1. This value will be pasted into the CyberQP Authentication Options "Certificate" value.  YOU MUST include the "---" characters and there cannot be any leading or trailing spaces or <CR>
            
   2. Copy the Thumbprint Value to your Clipboard
      
      
      
      1. This value will be pasted into the CyberQP Authentication Options "Fingerprint" Value.
         
         
2. Click Save/Save Changes
   
   
3. Sign in to the Passly Launchpad as an End User.
   1. You should see the CyberQP Box for the SSO application you just setup.
   2. Right click that icon and copy the associated HyperLink
      
      
      1. This value will be pasted into the CyberQP Dashboard Authentication Options "SAML Login Endpoint URL box.
         

Passly Values in the CyberQP Authentication Options Screen 

Copy and paste the SSO URLS from Passly to and from the CyberQP Dashboard to match these images

Testing

1. In another browser or an Incognito/Private Browser Log open the CyberQP Dashboard
   

   NA or Oceania	https://admin.getquickpass.com
   EU	https://eu-admin.getquickpass.com

2. Enter a Technician's Email address
3. Click Log In with SSO
   
4. Enter the Email Address that is configured for the Login Role Account you are testing - Click Log In
   
5. You should be prompted to sign into the Passly Single Sign-On Launchpad page just as you normally are.
6. Sign in with the credentials from the SSO Source you normally use.
7. You should be prompted with whichever Passly Sign In options you have configured as mandated for login.
8. Upon approval, the Technician should be logged into the CyberQP Dashboard with the proper account and permissions as assigned in the CyberQP Login Management.