Trustelem applications

Aha!

Configuration Aha!

Trustelem Configuration

Airbrake

Airbrake Configuration

Trustelem Configuration

Apimo

Activate SSO for APIMO

Please enable Trustelem for my Apimo subscription (https://mydomain.apimo.pro/homepage).

My base Trustelem URL for Apimo is https://mydomain.trustelem.com/app/93XXX

Modification should be applied on [put your desired date here] at [hour].

Setup Trustelem groups

Apimo requires the users' agency and profile.
Use the following procedure so as to make Trustelem transmit these attributes:

Notes:

AppDynamics

AppDynamics Configuration

function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
    msg.setAttr("username", user.firstname+"."+user.lastname);
}

Trustelem Configuration

function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
  for (let g in groups) {
      msg.addAttr("groups", groups[g].name);
  };
}

Arcgis

ArcGIS Configuration

Trustelem Configuration

AssetSonar

AssetSonar Configuration

Trustelem Configuration

Automox

Automox Configuration

Trustelem Configuration

AWS

AWS Configuration

Trustelem Configuration

Role Configuration

function getRoles(user: User, groups: Groups): string[] {
    return ["Role1", "Role2"];
}

Information

BambooHR

BambooHR Configuration

Trustelem Configuration

Blissbook

Blissbook Configuration

Trustelem Configuration

BlogIn

BlogIn Configuration

Trustelem Configuration

Bonusly

Bonusly Configuration

Trustelem Configuration

Boond Manager

BoondManager automatically connects users if login on Trustelem and BoondManager are equal.
You can force authentication through Trustelem - preventing users from signing in with their BoondManager password:

Box

Breezy

Breezy Configuration

Trustelem Configuration

Bugsnag

Bugsnag Configuraiton

Trustelem Configuration

CakeHR

CakeHR Configuration

Trustelem Configuration

Ci-book

    Please enable Trustelem for my ci-book subscription (https://sub-domain.ci-book.com).

    My Trustelem OAuth URLs for ci-book are:
    - https://mydomain.trustelem.com/app/166XXX/auth
    - https://mydomain.trustelem.com/app/166XXX/token
    - https://mydomain.trustelem.com/app/166XXX/resource

    Users should be forced to sign-in through Trustelem from [put the appropriate date here].
    In the meantime, please keep the standard login form together with Trustelem sign-in process.

CoderPad

Configuration CoderPad

ConnectWise Control

ConnectWise Configuration

Trustelem Configuration

function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
    for (const cust_group in groups) {
      if (cust_group === "admin") {
        msg.addAttr("role", "Control Administrator");
      }
    }
}

Coralogix

Coralogix Configuration

Trustelem Configuration

Corporama

    ClientID: trustelem.oauth2.gmyXXX
            
    ClientSecret: zokzH[...]DRY
            
    https://mydomain.dev.tlm.io/app/12XXX/auth
            
    https://mydomain.dev.tlm.io/app/12XXX/token
            
    https://mydomain.trustelem.com/app/12XXX/resource

Datadog

Datadog Configuration

Notes

Trustelem Configuration

Demo OIDC

Demo App configuration

Trustelem configuration

You're done!

Digital Recruiters

Configuration

Note

Dropbox

Envoy

Envoy Configuration

F5 Big-Ip

Supported Features

The integration currently supports the following features:

Configuration du VPN Big-Ip (SAML)

Before we start, we consider that the Standard Network Configuration of Big-Ip has already been done, please be sure to have a functional VPN
Note: For a Web Portal authentication the VPN config must include the Full Webtop Mode
First of all, in the Trustelem app settings, enable the authentication method you want to use

Configuration de Big-Ip

Trustelem Configuration

Big-Ip VPN Configuration (RADIUS)

Before we start, we consider that the Standard Network Configuration of Big-Ip has already been done, please be sure to have a functional VPN
Note: For a Web Portal authentication the VPN config must include the Full Webtop Mode

First of all, in the Trustelem app settings, enable the authentication method you want to use

Trustelem Configuration

Big-Ip Configuration

Facebook Workplace

Freshdesk

GitHub

GitHub Configuration

Trustelem Configuration

Information

GlassFrog

GlassFrog Configuration

Trustelem Configuration

Google

Harness

Harness Configuration

Trustelem Configuration

ITBoost

ITBoost Configuration

Trustelem Configuration

Join.me

KnowledgeOwl

KnowledgeOwl Configuration

function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
    msg.setAttr("username", user.firstname+"."+user.lastname);
}

Trustelem Configuration

Leapsome

Leapsome Configuration

Trustelem Configuration

Lockself

Introduction

Application configuration elements, on the SP side

Application configuration elements, on the IdP side

Mod Auth Mellon

Configuration

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

NameIDFormat" has to be adapted if you use a different one in Trustelem and Mellon.

<Location />
        Require valid-user
        AuthType "Mellon"
        MellonEnable "auth"
        MellonDefaultLoginPath "/"
        MellonEndpointPath "/endpoint"
        MellonSPentityId "https&#58;//localhost"
        &#35; Files generated by the script:
        MellonSPPrivateKeyFile "/etc/apache2/mellon/https_localhost.key"
        MellonSPCertFile "/etc/apache2/mellon/https_localhost.cert"
        MellonSPMetadataFile "/etc/apache2/mellon/https_localhost.xml"
        &#35; Metadata Trustelem:
        MellonIdPMetadataFile "/etc/apache2/mellon/metadata-125021.xml"
</Location>

Notes

Mod Auth OpenIDC

Configuration

LoadModule auth_openidc_module modules/mod_auth_openidc.so

Use a2enmod mod_auth_openidc and restart Apache for Debian

<VirtualHost *:443>
        # Server setup
        ServerName myapplication.tld
        # ... your particular directives ...
        # OpenID Connect setup
        OIDCProviderMetadataURL https://mydomain.trustelem.com/app/146XXX/.well-known/openid-configuration
        OIDCClientID trustelem.oidc.XXXXXXXXX
        OIDCClientSecret XXXXXXXX
        OIDCRedirectURI https://myapplication.tld/redirect_uri
        OIDCCryptoPassphrase XXXXXXXX
        OIDCScope "openid"
        <Location /sso-login>
            AuthType openid-connect
            Require valid-user
        </Location>
        # Specific session cookie durations (seconds)
        OIDCSessionInactivityTimeout 300
        OIDCSessionMaxDuration 36000
</VirtualHost>

The OIDCCryptoPassphrase parameter is used in particular for encrypting user session cookies.

Notes

claims["attr1"] = user.firstname;

Moodle

Moodle uses plugins to manage OpenID Connect authentication.

Download and Install

chown -R www-data:www-data oidc/

Configuration

Provider Name : leave empty or set the name of your choice
    Client ID : trustelem.oidc.gvsgcy3e
    Client Secret : PMlrIbFW6goMduZkPdaJj8yv99nbT33W{{customValue('tokenURL')}}
    Authorization Endpoint : https://mydomain.trustelem.com/app/383693/auth
    Token Endpoint https://mydomain.trustelem.com/app/383693/token
    Resource https://mydomain.trustelem.com/app/383693/userinfo
    Scope : openid profile email
    ```

* We recommend to activate the following option:

    * Force redirect. You can use the "?noredirect=1" URL param if your configuration is not working

* Setup Trustelem with the following parameters:

    * Your Moodle server URL
    * Login URL: the application's URL starting the OIDC flow. It is used as a target to the application on the Trustelem user's  dashboard.
    The URL may be : https://yourmoodledomain/

#### Optional configuration

* You can add the following code in the setClaims function of the "custom claims" section of trustelem application configuration to use user email instead of his identifier as username in Moodle application. 

```ts
claims["sub"] = user.email

Nextcloud

Settings

email

Identity provider Data

https://mydomain.trustelem.com/app/166XXX

https://mydomain.trustelem.com/app/166XXX/sso

Optional identity provider settings

https://mydomain.trustelem.com/app/166XXX/slo

Attribute mapping

Security settings / Signatures and encryption required

OAuth 2

Introduction

These settings allow you to connect Trustelem with any OAuth 2.0 compliant implementation.
Before you start the configuration make sure to have access to the OAuth 2.0 settings of the client application.

Configuration

Office 365

Introduction

Setup Powershell environment

Install-Module MSOnline

Connect to Azure AD

connect-msolservice

Change Office federation settings

$cert = "MIIDXXX...XXXZWCxicZzKAgV"

The contents of the certificat is available on the setup page of your Trustelem application

$FederationBrandName = "mydomain.com"

Set-MsolDomainAuthentication -DomainName mydomain.com -Authentication managed
Set-MsolDomainAuthentication       -DomainName mydomain.com `
-FederationBrandName             $FederationBrandName `
-Authentication                  Federated `
-PassiveLogOnUri                 https://mydomain.trustelem.com/app/34XXX/sso `
-SigningCertificate              $cert `
-IssuerUri                       https://mydomain.trustelem.com/app/34XXX/mydomain.com `
-LogOffUri                       https://mydomain.trustelem.com/app/34XXX/slo `
-PreferredAuthenticationProtocol SAMLP

Note for Azure AD users

⚠️Using an external IdP like Trustelem (via SAML) to federate Azure AD / Office 365 for users that exist only in the cloud leads to several critical issues and is strongly discouraged:

The consequences are the following:

Powershell script example to add onPremisesImmutableId to existing users:

# Install the Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser

# Connect to Microsoft Graph with the necessary scopes
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.AccessAsUser.All"

# Replace with your temporary fallback domain (e.g., yourdomain.onmicrosoft.com)
$tmpUPN = "yourdomain.onmicrosoft.com"

# Retrieve all users who don't have an OnPremisesImmutableId set
$users = Get-MgUser -All | Where-Object { -not $_.OnPremisesImmutableId }

foreach ($user in $users) {
    $currentUPN = $user.UserPrincipalName
    $initialDomain = $currentUPN.Split("@")[1]
    $newUPN = $currentUPN.Replace("@$initialDomain", "@$tmpUPN")

    # Temporarily change UPN to a domain that allows ImmutableId update
    Update-MgUser -UserId $user.Id -UserPrincipalName $newUPN

    # Generate a new unique ImmutableId (Base64-encoded GUID)
    $newImmutableId = [System.Convert]::ToBase64String([Guid]::NewGuid().ToByteArray())

    # Assign the ImmutableId to the user
    Update-MgUser -UserId $user.Id -OnPremisesImmutableId $newImmutableId

    # Revert UPN back to the original domain
    Update-MgUser -UserId $user.Id -UserPrincipalName $currentUPN
}

# List users who still don't have an ImmutableId (if any)
$usersWithoutImmutableId = Get-MgUser -All | Where-Object { -not $_.OnPremisesImmutableId } | Select-Object UserPrincipalName

Write-Output "Users without OnPremisesImmutableId:"
$usersWithoutImmutableId.UserPrincipalName

Powershell script example to create a new user with onPremisesImmutableId:

Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.AccessAsUser.All"

# Password profile as plain hashtable
$passwordProfile = @{
    Password = "TemporaryPassword123!"
    ForceChangePasswordNextSignIn = $true
}

# Build full user creation parameters in a hashtable (sûr et lisible)
$params = @{
    DisplayName      = "Peter Doe"
    GivenName        = "Peter"
    Surname          = "Doe"
    UserPrincipalName = "peter.doe@your_domain.onmicrosoft.com"
    MailNickname     = "peterdoe"
    PasswordProfile  = $passwordProfile
    AccountEnabled   = $true
}

# Create user
$newUser = New-MgUser @params

# If created, assign ImmutableId and switch UPN
if ($newUser -and $newUser.Id) {
    $immutableId = [System.Convert]::ToBase64String([Guid]::NewGuid().ToByteArray())
    Update-MgUser -UserId $newUser.Id -OnPremisesImmutableId $immutableId
    Update-MgUser -UserId $newUser.Id -UserPrincipalName "peter.doe@your_federated_domain.fr"
} else {
    Write-Error "User creation failed. Aborting further operations."
}

Disconnect-MgGraph

Olfeo SaaS

OpenID Connect

Introduction

Trustelem supports authorization code and implicit flows, as well as the OpenID Connect Discovery 1.1 standard.

If your application support the discovery standard

You need to configure the application with the following settings:

trustelem.oidc.gi2dXXXX

kmzHGEKEKFH51r0xXXXXXXXXXXXXX

https://mydomain.trustelem.com/app/150XXX

https://mydomain.trustelem.com/app/150XXX/.well-known/openid-configuration

If your application does not support the discovery standard

Additional parameters are necessary:

https://mydomain.trustelem.com/app/150XXX/auth

https://mydomain.trustelem.com/app/150XXX/token

https://mydomain.trustelem.com/app/150XXX/userinfo

{"keys":[{"kty":"RSA","use":"sig","kid":"150XXX","alg":"RS256","n":"XXX...XXX","e":"AQAB"}]}

Note

OpenVPN

OpenVPN Configuration

<LDAP>
    # URL of the server where TrustelemConnect is running
    URL ldap://address:port
    # Bind DN
    BindDN cn=trustelem,DC=mydomain,DC=trustelem,DC=com
    # Bind password
    Password xNc3x8T0hFtKKpQq
    # Network timeout (in seconds)
    Timeout 30
    # Enable Start TLS
    TLSEnable no
    # Follow LDAP Referrals (anonymously)
    FollowReferrals yes
    # TLS CA Certificate File
    TLSCACertFile /usr/local/etc/ssl/ca.pem
    # TLS CA Certificate Directory
    TLSCACertDir /etc/ssl/certs
    # Client Certificate and key
    # If TLS client authentication is required
    TLSCertFile /usr/local/etc/ssl/client-cert.pem
    TLSKeyFile /usr/local/etc/ssl/client-key.pem
    # Cipher Suite
    # The defaults are usually fine here
    # TLSCipherSuite ALL:!ADH:@STRENGTH
</LDAP>

<Authorization>
    # Base DN
    BaseDN DC=mydomain,DC=trustelem,DC=com
    # User Search Filter
    SearchFilter "(mail=%u)"
    # Require Group Membership
    RequireGroup false
    # Add non-group members to a PF table (disabled)
    #PFTable ips_vpn_users
    # Uncomment and set to true to support OpenVPN Challenge/Response
    #PasswordIsCR false
</Authorization>

OpenVPN configuration

Before starting, please be sure to have a functional VPN
Note: Please be sure to have a TrustelemConnect app correctly configured

OpenVPN configuration

Before starting, please be sure to have a functional VPN

Trustelem configuration

In the trustelem Login URL field enter:

Opsgenie

Opsgenie Configuration

https://mydomain.trustelem.com/app/33XXXX/sso

https://mydomain.trustelem.com/app/33XXXX/on_logout

$cert = "MIIDXXX...XXXNTYw=="

Trustelem Configuration

OwnCloud

Introduction

Application configuration elements, on the SP side

Application configuration elements, on the IdP side

PagerDuty

PagerDuty Configurationy

Trustelem Configuration

https://https://mydomain.trustelem.com/app/33XXXX/on_logout

ParkMyCloud

ParkMyCloud Configuration

Trustelem Configuration

Pingboard

Pingboard Configuration

Trustelem Configuration

Pipedrive

Trustelem Configuration

Proxyclick

Proxyclick Configuration

Trustelem Configuration

Pulse Secure

Before we start, please be sure to have a functional VPN

First of all, in the Trustelem app settings, enable the authentication method you want to use

Trustelem Configuration

Pulse Secure Configuration

Before we start, please be sure to have a functional VPN

First of all, in the Trustelem app settings, enable the authentication method you want to use

Trustelem Configuration

Pulse Secure Configuration

Pydio

Pydio requires a plugin to enable OpenID Connect authentication.

Download and installation

chown -R www-data:www-data authfront.openid/

Configuration

https://mydomain.trustelem.com/app/3XXXXX

{"keys":[{"kty":"RSA","use":"sig","kid":"58930","alg":"RS256","n":"03DSSaM_B0G70aclJFw-QK6HRl9hkFg2W5HKCGuAHm5wt2tP4FcQ8RMtLZ_WsdeFlUe9VdUGfACCSExq32k4XDR0PA5FJ9sE2pfGXIyyUP2drhqDI1Q754faHPjvkX5niiQkaNFby4HBjvsH6VWVU5PfHoHEeT20qemANWNlrfw8-jkMlN1aioWAuWI9L-OtGqUHEbZy_zj3GrZrAN7G73rClAtcgsIfeqkg3y5g2p4qRynS_MMmpuYiGz89Hcrr3lS52tKjHATskkII-eA-_78SB413KVKxRYSK9DjlA-Wm5Ott4AN99d6sVUIj0jp-fWSIueE4zy4OKrrQR91IYQ","e":"AQAB"}]}

{"issuer":"https://wallix-jflacher.trustelem.com/app/384294","authorization_endpoint":"https://wallix-jflacher.trustelem.com/app/384294/auth","token_endpoint":"https://wallix-jflacher.trustelem.com/app/384294/token","userinfo_endpoint":"https://wallix-jflacher.trustelem.com/app/384294/userinfo","jwks_uri":"https://wallix-jflacher.trustelem.com/app/384294/jwks","end_session_endpoint":"https://wallix-jflacher.trustelem.com/app/384294/end_session","scopes_supported":["email","family_name","given_name","groups","name","openid","organization","phone","profile","uid"],"response_types_supported":["code","code id_token","id_token","id_token token"],"grant_types_supported":["authorization_code","implicit"],"subject_types_supported":["public"],"display_values_supported":["page"],"claims_supported":["sub","iss","auth_time","acr","name","given_name","family_name","profile","email","locale","phone_number"],"ui_locales_supported":["fr-FR","en-GB"],"id_token_signing_alg_values_supported":["RS256"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post"]}

pydio_client_id

Rollbar

Rollbar Configuration

Trustelem Configuration

Salesforce

Introduction

Access to Salesforce parameters

Trustelem Configuration

Salesforce Configuration

SAML 2

Introduction

The SAML 2.0 configuration varies from application to application.
This page provides information about the most commonly used settings on both the application and Trustelem.
In SAML terminology, there is a client application which is called Service Provider (SP) and an identity provider (IdP), here Trustelem.

If you are the application developer

Note: our recommendation is to use OpenID Connect rather than SAML 2.0. OpenID Connect is more modern and more simple than SAML 2.0. If you still want to use SAML, you have 3 options:

Application configuration elements, on the SP side

Application configuration elements, on the IdP side

Slack

Trustelem Configuration

Slack Configuration

https://mydomain.trustelem.com/app/33XXXX/sso

https://mydomain.trustelem.com/app/33XXXX

$cert = "MIIDXXX...XXXNTYw=="

SmartRecruiters

SmartRecruiters Configuration

Trustelem Configuration

Add/edit a user with a SSO Identifier using API

Snowflake

Snowflake Configuration

use role accountadmin;
alter account set sso_login_page = TRUE;
alter account set saml_identity_provider =
'{
    "certificate": "MIIDUTCCAjmgAwIBAgIXXX",
    "issuer": "https://mydomain.trustelem.com/app/33XXXX",
    "ssoUrl": "https://mydomain.trustelem.com/app/33XXXX/sso",
    "type"  : "custom",
    "label" : "Trustelem" 
}';

Trustelem Configuration

SolarWinds Cloud

SolarWinds Configuration

Trustelem Configuration

function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
    msg.addAttr("groups", "memberSW");
    if (user.email == "john.doe@trustelem.com") {
    msg.addAttr("groups","adminSW");
    }
}

Sprout Social

Sprout Social Configuration

StatusHub

Tableau

Tableau Configuration

Trustelem Configuration

ThousandEyes

ThousandEyes Configuration

https://mydomain.trustelem.com/app/3XXXXX/on_logout

TYPO3

UseResponse

UseResponse Configuration

Trustelem Configuration

Velpic

Velpic Configuration

Notes

Trustelem Configuration

WALLIX Access Manager

Contents

Trustelem Radius on Access Manager for AD users

Install Trustelem Connect

Start by installing Trustelem Connect.
This will give Trustelem the ability to process Radius authentications.
The documentation is the following:
https://trustelem-doc.wallix.com/books/trustelem-administration/page/ldap-radius-trustelem-connect
You don't need to read the chapter Setup an application to use Trustelem Connect, the specific instructions for an Access Manager application will be detailed in this chapter.
The common mistakes will be also detailed, but if the authentication is not working you should start by reading the Debug chapter in this LDAP-Radius - Trustelem Connect documentation.

On Trustelem admin page

On Access Manager admin page

You can't test the authentication yet, first you need to define the access rules on Trustelem.
The documentation is provided in the page: https://trustelem-doc.wallix.com/books/trustelem-administration/page/access-rules
For this kind of authentication, you need a Radius access rule set to 2nd factor only.

Note: for the user authentication, first provide the AD login and password then provide the Trustelem TOTP code, even if the name of the input is Password again.

Trustelem Radius on Access Manager for AM users

Install Trustelem Connect

Start by installing Trustelem Connect.
This will give Trustelem the ability to process Radius authentications.
The documentation is the following:
https://trustelem-doc.wallix.com/books/trustelem-administration/page/ldap-radius-trustelem-connect
You don't need to read the chapter Setup an application to use Trustelem Connect, the specific instructions for an Access Manager application will be detailed in this chapter.
The common mistakes will be also detailed, but if the authentication is not working you should start by reading the Debug chapter in this LDAP-Radius - Trustelem Connect documentation.

On Trustelem admin page

On Access Manager admin page

You can't test the authentication yet, first you need to define the access rules on Trustelem.
The documentation is provided in the page: https://trustelem-doc.wallix.com/books/trustelem-administration/page/access-rules
For this kind of authentication, you need a:

Trustelem SAML on Access Manager for AD users

On Trustelem admin page

//Define a default profile attribute which matches the name of the Access Manager profile
msg.setAttr("profile","User")
//Change the default profile depending on the email address
if(user.email=="rose.keler@trustelem.demo"){msg.setAttr("profile","Auditor")}
//Change the default profile depending on Trustelem groups
for (let group in groups) {
  if(group=="Trustelem admin group name"){msg.setAttr("profile","Administrator")}
}

am-app2.png

On Access Manager admin page

You can't test the authentication yet, first you need to define the access rules on Trustelem.
The documentation is provided in the page: https://trustelem-doc.wallix.com/books/trustelem-administration/page/access-rules
For this kind of authentication, you need internal and external set to 2 factors

Trustelem SAML on Access Manager for Trustelem users

On Trustelem admin page

//Define a default profile attribute which matches the name of the Access Manager profile
msg.setAttr("profile","User")
//Change the default profile depending on the email address
if(user.email=="rose.keler@trustelem.demo"){msg.setAttr("profile","Auditor")}
//Change the default profile depending on Trustelem groups
for (let group in groups) {
  if(group=="Trustelem admin group name"){msg.setAttr("profile","Administrator")}
}

am-app2.png

On Access Manager admin page

You can't test the authentication yet, first you need to define the access rules on Trustelem.
The documentation is provided in the page: https://trustelem-doc.wallix.com/books/trustelem-administration/page/access-rules
For this kind of authentication, you need internal and external set to 2 factors

Debug

If the Radius authentication is not working:

If the SAML authentication is not working:

If after that you still you don't have a working SAML authentication, you can try 2 things:

WALLIX Bastion

Contents

Install Trustelem Connect

Start by installing Trustelem Connect.
This will give Trustelem the ability to process LDAP and Radius authentications.
The documentation is the following:
https://trustelem-doc.wallix.com/books/trustelem-administration/page/ldap-radius-trustelem-connect
You don't need to read the chapter Setup an application to use Trustelem Connect, the specific instructions for a Bastion application will be detailed in the next chapters.
The common mistakes will be also detailed, but if the authentication is not working you should start by reading the Debug chapter in this LDAP-Radius - Trustelem Connect documentation.

Trustelem LDAP on Bastion

On Trustelem admin page

On the Bastion admin page

You now have a working LDAP authentication, with access to targets based on Trustelem groups.
/!\ Trustelem users will not be found by the Bastion before having an access rule (1 or 2 factors)
The documentation to defined the access rules is provided in the page: https://trustelem-doc.wallix.com/books/trustelem-administration/page/access-rules
For this kind of authentication, you need a LDAP access rule set to 1 factor if it will be conbined with a Radius authentication or 2 factors if not.

What if I want to encrypt my LDAP flows?

The best way to encrypt the LDAP flows is simply to check startTLS on the Bastion. As Trustelem is compatible, flows are automatically encrypted.

The alternative is to implement LDAPS. To do this, there are several steps:
1/ Configure the connector.
On the Trustelem Connect folder, add a config.ini file and provide the following information
(adapted to your own repository and your own certifiates):

tls_cert = "C:\Program Files (x86)\Trustelem\connector.crt"
tls_cert_key = "C:\Program Files (x86)\Trustelem\connector.key"

Then, restart the connector service on your Virtual machine.
2/ Enable LDAPS on the Trustelem service.
3/ Enable SSL on the Bastion
4/ Optionally, add to the Bastion the authority certificate associated with the certificates used in step 1.

Trustelem Radius on Bastion for AD users

On Trustelem admin page

On the Bastion admin page

You can't test the authentication yet, first you need to define the access rules on Trustelem.
The documentation is provided in the page: https://trustelem-doc.wallix.com/books/trustelem-administration/page/access-rules
For this kind of authentication, you need a Radius access rule set to 2nd factor only If you want to skip the 2nd factor step for some users, you can select for them the rule Always allow instead on Trustelem.

If the authentication doesn't work correctly:

Trustelem Radius on Bastion for Bastion users

On Trustelem admin page

On the Bastion admin page

You can't test the authentication yet, first you need to define the access rules on Trustelem.
The documentation is provided in the page: https://trustelem-doc.wallix.com/books/trustelem-administration/page/access-rules
For this kind of authentication, you need a Radius access rule set to 2 factors

If the authentication doesn't work correctly:

Trustelem Radius on Bastion for Trustelem users

On Trustelem admin page

On the Bastion admin page

You can't test the authentication yet, first you need to define the access rules on Trustelem.
The documentation is provided in the page: https://trustelem-doc.wallix.com/books/trustelem-administration/page/access-rules
For this kind of authentication, you need a Radius access rule set to 2nd factor only If you want to skip the 2nd factor step for some users, you can select for them the rule Always allow instead on Trustelem.

If the authentication doesn't work correctly:

Wombat Security

WordPress

Supported Features

The integration currently supports the following features:

Configuration

Wordpress Config
Login Type: Auto Login-SSO
Client ID: trustelem.oidc.gi3XXXX
Client Secret Key: vly5yqnXXXX
OpenID Scope: email profile openid
Login Endpoint URL: https://mydomain.trustelem.com/app/160XXX/auth
Userinfo Endpoint URL: https://mydomain.trustelem.com/app/160XXX/userinfo
Token Validation Endpoint URL: https://mydomain.trustelem.com/app/160XXX/token
End Session Endpoint URL: https://mydomain.trustelem.com/app/160XXX/on_logout
Identity Key: name
Nickname Key: name
Trustelem Config

Beware of access control policies

Wordpress Config
  Entity ID: https://mydomain.trustelem.com/app/160XXX/
  Single SignOn Service URL: https://mydomain.trustelem.com/app/160XXX/sso
  Single Logout Service URL: https://mydomain.trustelem.com/app/160XXX/on_logout

  user_login: email
  user_email: email
  display_name: displayname
  first_name: firstname
  last_name: lastname
Trustelem Config

Workplace

Wrike

XWiki

XWiki Configuration

xwiki.authentication.authclass=org.xwiki.contrib.oidc.auth.OIDCAuthServiceImpl

oidc.xwikiprovider=https://mydomain.trustelem.com/app/150XXX
oidc.endpoint.authorization=https://mydomain.trustelem.com/app/150XXX/auth
oidc.endpoint.token=https://mydomain.trustelem.com/app/150XXX/token
oidc.endpoint.userinfo=https://mydomain.trustelem.com/app/150XXX/userinfo
oidc.scope=openid,profile,email
oidc.endpoint.userinfo.method=GET

oidc.user.nameFormater=${oidc.user.email}
oidc.user.subjectFormater=${oidc.user.subject}

oidc.clientid=trustelem.oidc.gvsteodb
oidc.secret=v0x8W4Gx97uycjBs18xeA5f6fkp2wyIY
oidc.endpoint.token.auth_method=client_secret_basic
oidc.skipped=false

Notes

Trustelem Configuration

Roles Configuration

oidc.userinfoclaims=xwiki_groups
oidc.groups.mapping=YourXWikiGroup=YourTrustelemGroup

const xwikiGroups: string[]= [];
for(let g in groups) {
  xwikiGroups.push(g);
}
claims["xwiki_groups"] = xwikiGroups;

claims["name1"] = user.getAttr("attribute1");

oidc.user.nameFormatter=${oidc.user.email}-${oidc.user.name1}

You Don't Need a CRM

Zabbix

Trustelem Configuration

function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
  msg.setAttr("username", user.firstname+"."+user.lastname);
}

Zendesk

Zendesk Configuration

Trustelem Configuration

  function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
  msg.setAttr("role","admin");
}

Zscaler Cloud

Zscaler Portal Cloud configuration

https://admin.zscloud.net/#administration/auth-settings

 function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
  &#32;&#32;msg.setNameID(user.upn);
 }

https://mydomain.trustelem.com/app/18XXXX/sso

If you want to turn ON the SAML Auto-Provisioning function

  function CustomSAMLResponse(msg: SAMLResponse, user: User, groups: Groups, deny: Deny): void {
    msg.setAttr('displayName', user.firstname + ' ' + user.lastname);
    msg.addAttr('groups', 'group1');
    msg.addAttr('groups', 'group2');
    msg.addAttr('groups', 'groupX');
    msg.setAttr('department', 'my_department');
  }

Note: instead of the constants "groupX" and "my_department", you can use other user's attributes.
For instance if you want to use Trustelem group attribute:

  for (let name  in groups){
    msg.addAttr('groups', name);
  }

Here is a complete example of custom scripting:

zscaler_custom_script.PNG

WALLIX Bastion SAML

This page is temporary, until we have a dedicated template on Trustelem and integration into the 'setup intructions' page dedicated to Bastion and AM.

Step 1: on Trustelem, create an application

As we don't have a dedicated template yet, you have to choose the generic SAML2 model.
Once the application is created, you can save it without any modification and then download the metadata file.

Step 2: on the Bastion, create an External authentication

On the Bastion admin interface:

  1. Create a new SAML external authentication (Configuration > External authentications)
  2. Upload the Trustelem metadata file on the field IdP metadata
  3. Complete the claims customization
    • Username: email or sAMAccountName, depending on whether Trustelem users come from the AD or not.
    • Display name: displayname
    • Email: email
    • Language: empty
    • Group: groups
  4. Click on apply
  5. Copy the SP entity ID and the SP assertion concumer service

Step 3: on the Bastion, create an Authentication domain

On the Bastion admin interface:

  1. Create a new Other IdPs authentication domain (Configuration > Authentication domains)
  2. Define a Domain server name
  3. Define an Authentication domain name
    • This value will be used to authenticate on the proxy if this Authentication domain is not the default one
    • This value will be used in the Access Manager setup, if you want to use this product
  4. Choose the Authentication protocole created in the 2nd step
  5. Define the Label for authentication button on the login page
  6. Define a default email domain
  7. Choose a default language
  8. Save the configuration
  9. Copy the IdP initiated URL

Step 4: on Trustelem, edit the previous application

Edit the application created at the 1st step.

Step 5: define the access & rights

Now the setup is ready, but users can't authenticate on the Bastion and don't have rights.

  1. On Trustelem, create permissions for users who should have access to the Bastion
  2. On the Bastion Authentication domain (step 3), create the mapping between the Bastion user groups and the groups existing on Trustelem

Access Manager with SAML Bastion

If you want to use Access Manager with SAML Bastion, the Access Manager should be > 5.0
In addition, some parameters on the SAML Access Manager should be identical as what was setup for the Bastion:

Finally, you have to create the same script for you SAML Access Manager app, as the one existing on the Bastion.

for (let g in groups){
  msg.addAttr("groups",g);
}