Tutorial: Azure AD SSO integration with Keeper Password Manager

In this tutorial, you'll learn how to integrate Keeper Password Manager with Azure Active Directory (Azure AD). When you integrate Keeper Password Manager with Azure AD, you can:

  • Control in Azure AD who has access to Keeper Password Manager.
  • Enable your users to be automatically signed-in to Keeper Password Manager with their Azure AD accounts.
  • Manage your accounts in one central location - the Azure portal.

Prerequisites

To get started, you need the following items:

  • An Azure AD subscription. If you don't have a subscription, you can get a free account.
  • Keeper Password Manager single sign-on (SSO) enabled subscription.

Note

This integration is also available to use from Azure AD US Government Cloud environment. You can find this application in the Azure AD US Government Cloud Application Gallery and configure it in the same way as you do from public cloud.

Scenario description

In this tutorial, you configure and test Azure AD single sign-on in a test environment.

To configure the integration of Keeper Password Manager into Azure AD, add the application from the gallery to your list of managed software as a service (SaaS) apps.

  1. Sign in to the Azure portal by using either a work or school account, or a personal Microsoft account.
  2. On the left pane, select the Azure Active Directory service.
  3. Go to Enterprise Applications, and then select All Applications.
  4. To add a new application, select New application.
  5. In Add from the gallery, type Keeper Password Manager in the search box.
  6. Select Keeper Password Manager from results panel, and then add the app. Wait a few seconds while the app is added to your tenant.

Configure and test Azure AD SSO for Keeper Password Manager

Configure and test Azure AD SSO with Keeper Password Manager by using a test user called B.Simon. For SSO to work, you need to establish a linked relationship between an Azure AD user and the related user in Keeper Password Manager.

To configure and test Azure AD SSO with Keeper Password Manager:

  1. Configure Azure AD SSO to enable your users to use this feature.

    1. Create an Azure AD test user to test Azure AD single sign-on with Britta Simon.
    2. Assign the Azure AD test user to enable Britta Simon to use Azure AD single sign-on.
  2. Configure Keeper Password Manager SSO to configure the SSO settings on the application side.

    1. Create a Keeper Password Manager test user to have a counterpart of Britta Simon in Keeper Password Manager linked to the Azure AD representation of the user.
  3. Test SSO to verify whether the configuration works.

Configure Azure AD SSO

Follow these steps to enable Azure AD SSO in the Azure portal.

  1. In the Azure portal, on the Keeper Password Manager application integration page, find the Manage section. Select single sign-on.

  2. On the Select a single sign-on method page, select SAML.

  3. On the Set up single sign-on with SAML page, select the pencil icon for Basic SAML Configuration to edit the settings.

    Screenshot of Set up Single Sign-On with SAML, with pencil icon highlighted.

  4. In the Basic SAML Configuration section, perform the following steps:

    a. For Identifier (Entity ID), type a URL using one of the following patterns:

    • For cloud SSO: https://keepersecurity.com/api/rest/sso/saml/<CLOUD_INSTANCE_ID>
    • For on-premises SSO: https://<KEEPER_FQDN>/sso-connect

    b. For Reply URL, type a URL using one of the following patterns:

    • For cloud SSO: https://keepersecurity.com/api/rest/sso/saml/sso/<CLOUD_INSTANCE_ID>
    • For on-premises SSO: https://<KEEPER_FQDN>/sso-connect/saml/sso

    c. For Sign on URL, type a URL using one of the following patterns:

    • For cloud SSO: https://keepersecurity.com/api/rest/sso/saml/sso/<CLOUD_INSTANCE_ID>
    • For on-premises SSO: https://<KEEPER_FQDN>/sso-connect/saml/login

    Note

    These values aren't real. Update these values with the actual Identifier,Reply URL and Sign on URL. To get these values, contact the Keeper Password Manager Client support team. You can also refer to the patterns shown in the Basic SAML Configuration section in the Azure portal.

  5. The Keeper Password Manager application expects the SAML assertions in a specific format, which requires you to add custom attribute mappings to your SAML token attributes configuration. The following screenshot shows the list of default attributes.

    Screenshot of User Attributes & Claims.

  6. In addition, the Keeper Password Manager application expects a few more attributes to be passed back in SAML response. These are shown in the following table. These attributes are also pre-populated, but you can review them per your requirements.

    Name Source attribute
    First user.givenname
    Last user.surname
    Email user.mail
  7. On Set up Single Sign-On with SAML, in the SAML Signing Certificate section, select Download. This downloads Federation Metadata XML from the options per your requirement, and saves it on your computer.

    Screenshot of SAML Signing Certificate with Download highlighted.

  8. On Set up Keeper Password Manager, copy the appropriate URLs, per your requirement.

    Screenshot of Set up Keeper Password Manager with URLs highlighted.

Create an Azure AD test user

In this section, you create a test user in the Azure portal called B.Simon.

  1. From the left pane in the Azure portal, select Azure Active Directory > Users > All users.
  2. At the top of the screen, select New user.
  3. In the User properties, follow these steps:
    1. For Name, enter B.Simon.
    2. For User name, enter the username@companydomain.extension. For example, B.Simon@contoso.com.
    3. Select Show password, and then write down the value shown.
    4. Select Create.

Assign the Azure AD test user

In this section, you enable B.Simon to use Azure single sign-on by granting access to Keeper Password Manager.

  1. In the Azure portal, select Enterprise Applications > All applications.
  2. In the applications list, select Keeper Password Manager.
  3. In the app's overview page, find the Manage section and select Users and groups.
  4. Select Add user. In Add Assignment, select Users and groups.
  5. In Users and groups, select B.Simon from the list of users. Then choose Select at the bottom of the screen.
  6. If you're expecting a role to be assigned to the users, you can select it from the Select a role list. If no role has been set up for this app, the Default Access role is selected.
  7. In Add Assignment, select Assign.

Configure Keeper Password Manager SSO

To configure SSO for the app, see the guidelines in the Keeper support guide.

Create a Keeper Password Manager test user

To enable Azure AD users to sign in to Keeper Password Manager, you must provision them. The application supports just-in-time user provisioning, and after authentication users are created in the application automatically. If you want to set up users manually, contact Keeper support.

Note

Keeper Password Manager also supports automatic user provisioning, you can find more details here on how to configure automatic user provisioning.

Test SSO

In this section, you test your Azure AD single sign-on configuration with following options.

  • Click on Test this application in Azure portal. This will redirect to Keeper Password Manager Sign-on URL where you can initiate the login flow.

  • Go to Keeper Password Manager Sign-on URL directly and initiate the login flow from there.

  • You can use Microsoft My Apps. When you click the Keeper Password Manager tile in the My Apps, this will redirect to Keeper Password Manager Sign-on URL. For more information about the My Apps, see Introduction to the My Apps.

Next steps

After you configure Keeper Password Manager, you can enforce session control. This protects exfiltration and infiltration of your organization’s sensitive data in real time. Session control extends from Conditional Access. For more information, see Learn how to enforce session control with Microsoft Defender for Cloud Apps.