Set up Identity Bridge for McAfee Cloud Single Sign On

Use this task to set up the Identity Bridge portion of the Directory Services Connector registered server. The Identity Bridge is available only if Cloud Single Sign On is enabled for your company on the Control Console. The Identity Bridge provides the ability to automatically authenticate users with corporate network credentials when they sign on to the Control Console and other applications in the cloud.

Before you begin

Identity Bridge uses the Integrated Windows Authentication (IWA) capability of Active Directory. Therefore, your company's Active Directory must have a security principal administered so that Identity Bridge can retrieve authentication credentials for your users. See "Configure a service principal user account in Active Directory" in the Directory Services Connector Getting Started Guide or Directory Services Connector online help.

Note To access the Control Console over the Identity Bridge, users must also configure their browsers. See "Configuring browsers for the Identity Bridge feature of Cloud Single Sign On" in the Directory Services Connector Getting Started Guide or Directory Services Connector online help .

Task

  1. Select Menu | Configuration | Registered Servers, then click the server name beginning with dsc.
  2. From the Actions drop-down list, select Edit.
    The Registered Server Builder: Description page appears.
  3. Click Next.
    The Registered Server Builder: Details page appears.
  4. Scroll down to the Identity Bridge Settings section.
  5. Check the Identity Bridge Authentication checkbox to enable Identity Bridge and to enable the remaining configuration fields.
  6. In the Company IP Address Range field, enter a single range of IP addresses, using CIDR notation, for example, 12.39.58.0/24. The range of IP addresses should include all users that can access Cloud SSO from a corporate sign in. The CIDR value must meet the following requirements:
    • The IP address is valid.
    • The netmask is between 24 and 32, inclusive.
    • The IP address and netmask are compatible with CIDR notation.
  7. In the ePO Hostname field, Directory Services Connector automatically enters the ePO server name and port number on which you are running Directory Services Connector and Identity Bridge, for example denver1.acme.com:8443. You must verify that the host name and port number are correct. If not, you must change them. In some cases, perhaps for traffic load balancing, you might wish to use the host name of a different ePO server, if any, in your corporate network.
    Note Do not change the host name and default port number in the ePO Hostname field unless you are sure the host name and port number you want to substitute will work.
  8. In the Active Directory Server Principal Name field, enter the security principal name to be used to connect with Active Directory for authentication of users accessing the Control Console. The format of the name should be HTTP/<server_name_for_ID_Bridge>@<AD_DOMAIN_NAME>, where HTTP and <AD_DOMAIN_NAME> are in all uppercase. For example, if you entered denver1.acme.com in Step 7 and the AD domain of your users is ADcorp1.int, you would enter HTTP/denver1.acme.com@ADCORP1.INT.
  9. In the Server Principal Password field, enter the password for the security principal to be used when connecting to the Active Directory domain.
  10. Click Save.