Integrate KnowBe4

KnowBe4 provides an integrated platform for security awareness combined with simulated phishing attacks (see https://knowbe4.com). You can protect access to KnowBe4 by integrating KnowBe4 with Identity as a Service. Once integrated, users can use single sign-on to log in to their KnowBe4 account through Identity as a Service.

Note: This integration was tested using Identity as a Service version 5.15 and KnowBe4 version February 2021. Other versions of KnowBe4 may require integration and configuration steps that differ from those documented in this procedure. For other versions of KnowBe4, this integration guide may be used as an initial approach for integrating KnowBe4. In the event of other issues, contact support@entrust.com for assistance.

To integrate KnowBe4 with Identity as a Service, you must do the following:

Step 1: Copy the KnowBe4 Identity Provider SAML configurations

Copy the KnowBe4 SAML configurations

1. Log in to your KnowBe4 account. The Dashboard page appears.

2. In the top-right, click the menu button () next to your account (profile) name and the Help () icon.

3. Click Account Settings from the drop-down list. The Account Settings page appears.

4. Scroll to the SAML section.

5. Click SAML Settings. The SAML Settings appear.

6. Copy the following and save them in a text file, such as Notepad. You need these values in Step 2: Add KnowBe4 to Identity as a Service.

● SSO Callback (ACS) URL

● SSO Sign-out URL

Note: You can leave this page open as you need it in Step 6: Configure KnowBe4 for Identity as a Service authentication.

Step 2: Add KnowBe4 to Identity as a Service

Add KnowBe4 as an application to Identity as a Service

1. Log into your Identity as a Service administrator account.

2. Click > Security > Applications. The Applications Lists page appears.

3. Click Add. The Select an Application Template page appears.

4. Do one of the following:

● Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.

- or -

● In the Search bar, enter a search option to filter for the application you want to add to IDaaS.

5. Click KnowBe4. The KnowBe4 page appears.

6. Enter an Application Name.

7. Enter an Application Description.

8. Optional. Add a custom application logo.

a. Click next to Application Logo. The Upload Logo dialog box appears.

b. Click to select an image file to upload.

c. Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.

d. If required, resize your image.

e. Click OK.

9. Select the Authentication Flow that appears to users during login.

10. Click Next. The General page appears.

11. In the Default Assertion Consumer Service URL field, enter the SSO Callback ACS URL you copied in Step 1: Copy the KnowBe4 SAML configurations.

https://knowbe4.com/auth/saml/<1234abc567d8>/callback where <1234abc567d8> is your unique KnowBe4 SAML ID value.

12. In the Service Provider Entity ID (Issuer) field, enter:

KnowBe4

13. In the Single Logout Service URL field, enter the SSO Sign-out URL you copied in Step 1: Copy the KnowBe4 SAML configurations.

https://knowbe4.com/auth/saml/<1234abc567d8>/logout where <1234abc567d8> is your unique KnowBe4 SAML ID value.

14. Optional. Enter the SAML Username Parameter Name used to identity the user ID being requested for authentication. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identify the IDaaS userID.

15. Enter the SAML Session Timeout to the time when the SAML Assertion times out. The maximum is 720 minutes.

16. Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.

17. From the SAML NameID Attribute drop-down list, select Email.

18. From the SAML NameID Encoding Format drop-down list, select Email.

19. From the SAML Signing Certificate from the drop-down list, select the signing certificate.

20. From the SAML Signature Algorithm drop-down list, select SHA512.

21. Select Sign Complete SAML Response.

22. Deselect Enable Go Back Button if you do not want users to be able to go back to the KnowBe4 login page to log in.

23. Select Show Default Assertion Consumer URL Service in the My Profile. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.

24. Optional. Add Alternative Assertion Consumer Service URLs, as follows:

a. Click Add.

b. Enter a Name.

c. Enter a URL Value.

d. Select Show in My Profile to display the Alternative Consumer Service URL in a user's My profile page.

e. Optional. Add an Application Logo.

f. Click Add.

g. Repeat these steps to add more Alternative Assertion Consumer Service URLs.

25. Click Submit.

Step 3: Add a resource rule

Copy the SAML Configuration from Identity as a Service

1. Log into your Identity as a Service administrator account.

2. Click > Security > Applications. The Applications Lists page appears.

3. Under SAML Cloud Integrations, click SAML Configuration. The SAML Configuration dialog box appears.

This dialog box contains information you need to configure your SAML application for Identity as a Service authentication.

4. Do one of the following:

● Leave this dialog box open to reference later in this procedure.

● Copy the Entity ID, Single Sign-on URL, and Single Logout URL to a text file and save it to reference later in this procedure.

Note: Depending on the integration you are performing, you may not need all three of these SAML configuration values.

Step 5: Export the SAML signing certificate from Identity as a Service

Export a SAML signing certificate

1. Log in to your Identity as a Service administrator account.

1. Click > Security > Applications. The Applications List page appears.

2. Under SAML Cloud Integrations, click SAML Signing Certificates. The SAML Signing Certificates page appears.

3. Click next to the certificate to export the certificate you want to import into your SAML service provider application. The Export Certificate dialog box appears.

a. If the certificate has been issued by a CA, do one of the following:

– Click Certificate to export the self-signed certificate.

– Click Root CA Certificate to export a certificate issued from a CA.

– Click Certificate Chain to export the SAML signing certificate and its CA certificates.

b. Click Export.

Step 6: Copy the IdP Certificate Fingerprint

Copy the certificate fingerprint

1. Locate the saml-cert-SAML Certificate.cer file you downloaded in Step 5: Export the SAML signing certificate from identity as a Service.

2. Double-click to open it the certificate. The Certificate Information dialog box appears.

3. Click the Details tab.

4. Scroll and click Thumbprint.

5. Copy the values that appear in the field and paste them in a text editor, such as Notepad.

Step 7: Configure KnowBe4 for Identity as a Service authentication

Configure KnowBe4 for Identity as a Service

1. Log in to your KnowBe4 account. The Dashboard page appears.

2. In the top-right, click the menu button () next to your account (profile) name and the Help () icon.

3. Click Account Settings from the drop-down list. The Account Settings page appears.

4. Scroll to the SAML section.

5. Click SAML Settings. The SAML Settings appear.

6. Select Enable SAML SSO.

7. Select Allow SAML User Provisioning.

8. In the IdP SSO Target URL, paste the Single Sign-On URL you copied in Step 4: Copy the SAML configurations from Identity as a Service.

9. In the IdP Fingerprint section, do the following:

a. Select SHA-256.

b. In the text box, paste the fingerprint certificate that you created in Step 6: Copy the Idp Certificate Fingerprint.

10. Click Save SAML Settings.