SAML Authentication

You can configure SAML authentication so that Tenable Security Center users can use identity provider-initiated single sign-on (SSO) when logging in to Tenable Security Center. Tenable Security Center supports SAML 2.0-based authentication (for example, Okta, OneLogin, Microsoft ADFS, or Shibboleth 2.0).

For more information, see:

After you configure SAML authentication, create Tenable Security Center user accounts for each SAML user you want to grant access.

To manually add SAML-authenticated users in Tenable Security Center, see Add a SAML-Authenticated User.
To automatically add SAML-authenticated users by importing users from your SAML identity provider, see SAML User Provisioning.

Then, users with SAML-authenticated accounts can log in to Tenable Security Center using the Sign In Using Identity Provider button, as described in Log In to the Web Interface.

Considerations for Advanced SAML Features

Tenable Security Center uses the open-source SimpleSAMLphp library for SAML authentication. Tenable Security Center supports standard SAML 2.0 authentication but does not support SAML assertion encryption. If you want to configure SAML authentication, choose an identity provider that does not require assertion encryption and confirm that assertion encryption is not enabled. For information about Tenable Security Center communications encryption, see Encryption Strength.

Signatures. Configure your identity provider to use the RSA-SHA256, RSA-SHA384, or RSA-SHA512 signature algorithm. Do not use RSA-SHA1 or ECDSA signature algorithms. At least one of the SAML response or the SAML assertion must be signed. If your identity provider supports it, Tenable recommends signing both.

Time synchronization. Configure the time source for the Tenable Security Center host and your identity provider using the same time service, such as NTP. If the time on either system differs beyond the allowed tolerance, authentication fails with an error similar to IssueInstant is not within bounds.

Single logout. Tenable Security Center does not initiate single logout (SLO). Logging out of Tenable Security Center ends only your Tenable Security Center session and does not log you out of your identity provider. Configure session timeouts in your identity provider to meet your requirements. If your identity provider does not support single logout, leave the Single Logout Service field blank or enter a placeholder value.

Note: The Single Logout Service field does not affect authentication. Tenable Security Center does not send logout requests to your identity provider.

Logging in. Users log in to Tenable Security Center using the Sign In Using Identity Provider button, as described in Log In to the Web Interface. After logging in, direct links to dashboards or reports redirect you to the default page. Re-open the link after you log in.

User identification. By default, Tenable Security Center uses the SAML NameID as the username. To use a different assertion attribute, type the attribute name in the Username Attribute box. The attribute name is case-sensitive and must match exactly as it appears in your identity provider SAML configuration. You can use any attribute, such as displayName, userPrincipalName, or sAMAccountName. Tenable Security Center uses the first value of the attribute.

User provisioning attributes. If you enable user provisioning, your identity provider must send the following attributes in the SAML assertion. Type the attribute names exactly as they appear in your identity provider configuration.

Tenable Security Center Field	Attribute Name	Value
Organization ID	tenableOrgID	The numeric organization ID displayed in Tenable Security Center
Group ID	tenableGroupID	The numeric group ID displayed in Tenable Security Center
Role ID	tenableRoleID	The numeric role ID displayed in Tenable Security Center. If the role is Administrator, the Organization ID must be 0

You can also send the following optional attributes: tenableFirstName, tenableLastName, tenableTitle, tenableEmail, tenableAddress, tenableCity, tenableState, tenablePhone, tenableCountry, and tenableTimezone. For tenableTimezone, use a time zone identifier such as America/New_York. Each organization, group, and role assignment is applied when Tenable Security Center provisions the user. Tenable Security Center does not re-evaluate these assignments when the user logs in again. If you enable user data sync, Tenable Security Center updates contact information at each login.

Identity provider certificates. Updating the identity provider signing certificate does not require you to restart Tenable Security Center. Import your identity provider metadata again or update the certificate data in the SAML configuration. The new certificate takes effect the next time a user logs in. Tenable Security Center stores a single certificate. Complete your identity provider certificate rollover before you update the certificate in Tenable Security Center.

Backing up SAML configuration. A full backup and restore to a new host retains your SAML configuration. The host name or IP address of the new host does not affect your SAML configuration.

Advanced configuration. Tenable Security Center regenerates its SAML configuration files when you change the SAML configuration. Do not edit these files directly. To configure SAML options that are not available in the interface, use the configuration override files authsources-custom.php and saml20-idp-remote-custom.php, located in the same directories. For more information, see Using a Custom entityID with Tenable Security Center SAML.

Note: Tenable Support does not assist with configuring or troubleshooting advanced SAML features.

SAML Authentication Options

Option	Description
SAML	Specifies whether SAML authentication is enabled or disabled. If you disable SAML, the system clears your SAML configuration settings and prevents SAML-authenticated user accounts from accessing Tenable Security Center.
Source	Specifies your SAML configuration method: Import — Configure SAML authentication by uploading the metadata file provided by your identity provider, as described in Configure SAML Authentication Automatically via the User Interface. Entry — Configure SAML authentication by manually configuring SAML options using data from the metadata file provided by your identity provider, as described in Configure SAML Authentication Manually via the User Interface.
Type	Specifies the identity provider you are using: SAML 2.0 (e.g., Okta, OneLogin, Shibboleth 2.0, etc.).
Entity ID	The name of the Entity ID attribute. Type the attribute exactly as it appears in your identity provider SAML configuration. The Entity ID must be in URL format. Tip: This is the Federation Service Identifier value in Microsoft ADFS.
Identity Provider (IdP)	The identity provider identifier string. For example: The Identity Provider Issuer value in Okta. The Federation Service Identifier value in Microsoft ADFS.
Username Attribute	The name of the SAML username attribute. Type the attribute exactly as it appears in your identity provider SAML configuration. For example, if your SAML username attribute is NameID, specify NameID to instruct Tenable Security Center to recognize users who match the format NameID=username.
Single Sign-on Service	The identity provider URL where users log in via single sign-on. Type the URL exactly as it appears in your identity provider SAML metadata.
Single Logout Service	The identity provider URL where users log out. Type the URL exactly as it appears in your identity provider SAML metadata.
Certificate Data	The text of the identity provider's X.509 SSL certificate, without the ===BEGIN CERT=== and the `===END CERT===` strings.
User Provisioning	You can enable user provisioning to automatically create SAML-authenticated users in Tenable Security Center by importing user accounts from your SAML identity provider. When user provisioning is enabled, users who log into your SAML identity provider are automatically created in Tenable Security Center. For more information, see SAML User Provisioning. Note: If you want to delete a Tenable Security Center user that was created via SAML user provisioning, delete the user from your SAML identity provider. If you delete a user in Tenable Security Center that was created via SAML user provisioning without deleting the user in your SAML identity provider, Tenable Security Center automatically re-creates the user in Tenable Security Center the next time they log in using your SAML identity provider.
User Data Sync	If you enabled User Provisioning, you can enable User Data Sync to allow Tenable Security Center to automatically synchronize contact information from your SAML identity provider for Tenable Security Center users created via SAML user provisioning. For more information, see SAML User Provisioning. Note: If you want to edit a Tenable Security Center user that was created via SAML user provisioning and you enabled User Data Sync, edit the user in your SAML identity provider. Otherwise, the Tenable Security Center user data sync overwrites your changes the next time the user logs in to Tenable Security Center using your SAML identity provider. Note: Tenable Security Center does not update required fields (Organization ID, Group ID, and Role ID). To change the organization, group, or role for a user created via SAML user provisioning, see Manage User Accounts.