SAML for Other Identity Providers

Tenable supports any SAML 2.0-compliant identity provider (IdP). This topic collects the Tenable values and requirements you need when your IdP does not have its own guide in this document. It does not give step-by-step instructions for your IdP. For the IdP-side steps, find the equivalent field in your IdP's SAML 2.0 application setup and map the values described below.

Note: This topic is generic. It describes only the Tenable values and requirements for SAML, and it has not been tested with every IdP. For complete instructions on configuring SAML in your identity provider, including the exact field names and steps, see your IdP's documentation.

Before You Begin

Requirement	Detail
IdP supports SAML 2.0	Tenable accepts any SAML 2.0-compliant IdP, with the limits described in this topic.
Assertion encryption	Depends on the product. See Assertion Encryption.
Sign-in flow	Tenable One Vulnerability Management SAML is IdP-initiated only. See Sign-In Flow: IdP-Initiated Only.
Usernames	Each Tenable username is an email address, for example [email protected]. The username your IdP sends must match an existing Tenable user, or the user is created if auto-provisioning is enabled.

Values Tenable Provides to Your IdP

These are the values you enter in your IdP's SAML application. In Tenable One and Tenable One Vulnerability Management, Tenable generates a UUID when you save the SAML configuration, so you complete the setup in two passes: create the IdP application with placeholders, save the Tenable configuration, then replace the placeholders.

IdP Field (Common Names)	Tenable One / Tenable One Vulnerability Management	Tenable Security Center	Tenable One Identity Exposure
ACS URL (also called Single sign-on URL, Login URL, Reply URL, Recipient URL, Destination URL)	https://cloud.tenable.com/saml/login/<SAML config UUID> FedRAMP: https://fedcloud.tenable.com/saml/login/<SAML config UUID> The URL is case-sensitive.	https://<Tenable Security Center host or IP>/saml/module.php/saml/sp/saml2-acs.php/1	The assert endpoint of the Tenable One Identity Exposure service provider, shown in Tenable One Identity Exposure. The Okta guide uses this same value for the single sign-on URL and the audience.
Entity ID / Audience URI (also called SP Entity ID, Audience Restriction)	TENABLE_IO_<SAML config UUID>	https://tenable.sc (must be in URL format)	Same value as the assert endpoint above.
Name ID format	Unspecified	Unspecified	Not specified in this guide.
Name ID / application username value	The user's email address	The user's email address	Not specified in this guide.
RelayState	Leave blank.	Leave blank.	Not specified in this guide.
SP metadata file	After you save the SAML configuration, click Download SAML SP metadata to get a metadata.xml file that contains the real ACS URL and entity ID.	The Okta guide uses the IdP metadata and does not describe an SP metadata download.	Not described in this guide.

Tip: The entity ID and ACS URL must match what Tenable generated exactly. The most common cause of failed logins is an incorrect entity ID.

Values Your IdP Provides to Tenable

Tenable One and Tenable One Vulnerability Management

In the SAML configuration, you can either upload your IdP's metadata.xml file (Import XML) or enter the values manually (Manual Entry).

Tenable Field	What to Provide from Your IdP
IdP Entity ID	The unique entity ID (issuer) your IdP uses. If you configure more than one IdP, each configuration needs its own entity ID, IdP URL, and signing certificate.
IdP URL	The SAML single sign-on URL of your IdP.
Certificate	Your IdP's signing certificate, copied from the IdP metadata.
Type	SAML 2.0. This field is read-only.

Signing certificate requirements

Tenable extracts only the first certificate in the IdP metadata object and does not support multiple certificates. If your metadata lists more than one certificate, make sure the signing certificate is first, or select the correct certificate manually in Tenable.
The certificate in your IdP configuration must match the certificate in Tenable. If it does not, Tenable rejects authentication.
An expired certificate in the metadata file can cause "incorrectly signed, or missing field" errors.

Whether the IdP must sign the assertion, the response, or both is not stated elsewhere in this guide.

Tenable Security Center

Provide your IdP's metadata (or the equivalent IdP values) in the Tenable Security Center SAML configuration.

Tenable Security Center extracts only the first certificate from the metadata object.

Tenable One Identity Exposure

URL of the SAML server: your IdP's SSO URL.
Trusted Certificate Authorities: your IdP's X.509 signing certificate in PEM format, beginning with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----.
SAML group names that map to Tenable One Identity Exposure access. The Okta guide uses Tenable_users and Tenable_admins as examples.

Assertion Encryption

Requirements differ by product.

Product	Assertion Encryption
Tenable One / Tenable One Vulnerability Management	Not supported. Tenable cannot accept private keys to decrypt assertions. Choose an IdP that does not require encryption and confirm that encryption is disabled.
Tenable Security Center	Not supported. Tenable Security Center cannot accept private keys to decrypt assertions. Choose an IdP that does not require encryption and confirm that encryption is disabled.
Tenable One Identity Exposure	Required. Enable assertion encryption in your IdP and upload the encryption certificate you download from Tenable One Identity Exposure. The Okta example sets Assertion Encryption to Encrypted and uploads that certificate.

Sign-In Flow: IdP-Initiated Only

Tenable One Vulnerability Management SAML is IdP-initiated. Tenable does not support the SP-initiated flow. Users must start from the IdP (the IdP tile or dashboard, or the ACS URL from the SP metadata, for example cloud.tenable.com/saml/login/<UUID>). Browsing directly to cloud.tenable.com does not trigger SSO.

After SAML is configured for a user, the user must sign in once from the IdP tile or SP metadata URL and then sign out before the Sign in via SSO link works on the Tenable login page. If the user clears their browser cookies or cache, they must sign in from the IdP again.

Role and Group Assignment Attributes

Tenable One and Tenable One Vulnerability Management

Attribute	Purpose
userRoleUuid	Assigns a Tenable user role. Set the attribute name to userRoleUuid (name format: Basic) and the value to the role UUID. To find role UUIDs, go to Settings > Access Control > Roles. Requires User Auto Provisioning Enabled, plus IdP Assigns User Role at Provisioning and/or IdP Resets User Role at Each Login.
groups	Adds users to a Tenable user group that has Managed by SAML selected. Requires Group Management Enabled in the SAML configuration. The group name your IdP sends must match the Tenable user group name exactly. Name format: Basic.

Important: Tenable creates users at their first successful SAML login. It does not fully process the userRoleUuid claim until the user signs out and signs in a second time. On first login, the user might receive a default baseline role.

To send a different role for each user, define a custom user attribute in your IdP's user profile that holds the role UUID, and map it to userRoleUuid. This approach is shown in the Okta example.

Tenable Security Center

Tenable Security Center maps IdP attributes to organization, group, and role.

Tenable One Identity Exposure

Tenable One Identity Exposure uses a groups attribute whose values match the SAML group names configured in Tenable One Identity Exposure. The Okta example sends groups with name format Unspecified and a "Starts with Tenable" filter.

Map the Values to Your IdP's Equivalent Fields

Field names vary between IdPs. Use this table to translate the Tenable values to your IdP.

Tenable Value	Look for This in Your IdP
ACS URL	Single sign-on URL, Assertion Consumer Service (ACS) URL, Reply URL, or Login URL. If the IdP asks, set Recipient and Destination to the same URL.
Entity ID	Audience URI, SP Entity ID, Audience Restriction, or Identifier.
Name ID	Name ID format Unspecified (or email address), with the user's email address as the value.
Attribute statements	Custom attribute or claim mappings, such as userRoleUuid and groups.
IdP metadata and certificate	Metadata URL or XML download, and the X.509 signing certificate.
Assertion encryption	Disable it for Tenable One, Tenable One Vulnerability Management, and Tenable Security Center.

Assign Users to the Application

Assign the Tenable application to the users or groups in your IdP who need access. If user auto-provisioning is disabled, each user must already exist in the Tenable container where you created the SAML configuration.

Multiple Tenable Containers

Tenable usernames must be unique across every container on a site and cannot be edited after creation. If a user needs access to more than one container, your IdP must send a unique, container-specific username for each container instead of the default email address. Otherwise, the user sees a "failed to login using SAML" error.

Troubleshooting for Any IdP

The following errors come from the Troubleshooting and Common Errors topic.

Symptom	Check
"incorrectly signed, or missing field"	The certificate order in the metadata (Tenable uses the first), expired certificates, or the wrong certificate selected.
"This Username does not exist."	The NameID value and format. Your IdP must send the email address as the NameID.
"Assertion audience does not include issuer"	The Audience URI or entity ID in your IdP does not match the Tenable value.
"failed to login using SAML"	The same username exists in more than one container. See Multiple Tenable Containers.
User not found, with a username that is missing the @domain portion	Your IdP is sending a short username instead of the full email address. Adjust the claim or transform rule.
401 "Missing authentication"	The user is not in the group configured in your IdP.