Trellix Wise™ for Private Cloud supports the following identity provider protocols:
SAML
OIDC (OpenID Connect)
LDAP with optional LDAPS (TLS) configuration
The Identity Providers table displays configured providers with Domain, Type, Description, and Status columns. The Status column shows Enabled, Warning, or Disabled.
If you have not configured any identity providers, the page displays an Add Identity Provider button.
Prerequisites
Verify these requirements before you add or edit an identity provider:
An Admin or Super Admin account in Trellix Wise™ for Private Cloud.
Administrative access to the external identity provider.
A test user account existing in both Trellix Wise™ for Private Cloud and the external identity system.
A matching user account in the tenant for each user who authenticates through SAML, OIDC, or LDAP. The username must match the identity value returned by the provider. Trellix Wise™ for Private Cloud does not automatically create a local user after authentication.
Network connectivity between Trellix Wise™ for Private Cloud, the identity provider or LDAP server, and the users' browsers.
Permitted firewall connections.
Add a SAML identity provider
Log in to Trellix Wise™ for Private Cloud.
Go to Settings > Users > Identity Providers.
Select Add Identity Provider.
Select the SAML tab.
Enter the Connection Name, Entity ID, and SSO URL.
Enter the Signing Certificate.
Select Validate.
Select Other Settings to enable:
Sign authentication requests: Signs each sign-in request sent to the identity provider. The identity provider must be configured to accept signed requests.
Require encrypted assertions: Rejects assertions that are not encrypted by the identity provider.
Require encrypted Name ID: Rejects assertions with an unencrypted Name ID.
Sign published metadata: igns the metadata published by Trellix Wise™ for Private Cloud.
Review the Hand-off Values after validation succeeds.
Select the copy icon to copy the ACS / Callback URL or SP Entity ID.
Select Save.
Add an OIDC identity provider
Go to Settings > Users > Identity Providers.
Select Add Identity Provider.
Select the OIDC tab.
Enter the Connection Name, Issuer / Discovery URL, Client ID, and Client Secret.
Select Validate.
Review the Hand-off Values and copy the Redirect URL if needed.
Select Save.
Add an LDAP identity provider
Go to Settings > Users > Identity Providers.
Select Add Identity Provider.
Select the LDAP tab.
Enter a name for the LDAP connection and the Server Hostname or IP address of your LDAP server.
Enter the credentials of the account that Trellix Wise™ for Private Cloud uses to connect to the LDAP server:
Bind Username
Bind Password
Enter the Base DN that defines where the Wise application searches for users in the LDAP directory.
Expand Other Settings to enter the Server URL & Port, User Search Filter, and CA Certificate if required.
Select Validate.
Review the validation message.
Select Save.
Edit or delete identity providers
Note
You cannot change the protocol for an existing identity provider.
Go to Settings > Users > Identity Providers.
To find a specific identity provider, enter a connection name, type, or description in Filter, then select Refresh to reload the list.
To edit or delete an identity provider, select the three-dot menu at the end of the identity provider row.
Select the required option:
Edit — Opens the Edit Identity Provider dialog. Update the configuration fields and select Validate, then Update. You cannot change the protocol for an existing identity provider. Secret and password fields are masked. If you change a secret, you must revalidate the connection.
Delete — Opens the Delete Domain dialog. Review the confirmation message and select Delete.