Keeper Security

This guide describes how to integrate Keeper Security with Ironchip over SAML. Ironchip acts as the identity provider and Keeper Security, with SSO Connect Cloud, as the service provider.

Caution

All users must have an email address from a domain associated with your organization in Keeper Security.

Requirements

• Access to the Ironchip admin console.
• A user with permissions to make the configuration in Keeper Security.

Configure Keeper Security

1. Sign in to the Keeper Security admin console.

2. Open the Admin tab.

3. In Node, select the node you want to apply the Ironchip configuration to.

4. Go to the Provisioning tab.

5. Click Add Method and create an SSO Connect Cloud single sign-on method.

6. Open the three-dot menu on the right of the method and select View.

   

7. Click Export Metadata to download the Keeper Security metadata. Upload the file content to a public URL so Ironchip can read it, and save that URL, because you will use it later.

   

8. Before continuing in Ironchip, edit the method from the three-dot menu. Under the identity provider attribute mappings, enter uid in Email. Ironchip only needs the email: leave the other fields empty.

   

Configure Ironchip

1. In the Ironchip admin console, go to Applications and click the green New application button.

   

2. Select the SAML type and download the Ironchip metadata with Download metadata file.

   

3. In the Metadata URL field, enter the Keeper metadata URL you got earlier. This is the URL Ironchip uses to communicate with Keeper.

   

4. Click Add service to finish the configuration in Ironchip.

5. Back in Keeper Security, edit the SSO Connect Cloud method again. Under Identity Provider, set IDP Type to GENERIC, click Browse Files under SAML Metadata, and select the metadata file you downloaded from Ironchip.

   

Verify the integration

Before you test, give the user you will sign in with access to the Ironchip application. The steps are in Add users to the service.

1. Open the Keeper Security sign-in page and sign in with SSO using an email address from a domain associated with your organization.
2. Keeper Security redirects you to Ironchip to authenticate.
3. Complete the authentication on your device. Ironchip returns you to Keeper Security with your session started.

Troubleshooting

Node error

Keeper shows this error when the user does not belong to the node where SSO Connect is configured:

For security reasons, any user who logs in with SSO must be provisioned to the SSO-enabled node in the Keeper Admin Console.

Move the user to the node where you configured SSO Connect.

Email domain error

Keeper shows this error when the email domain is not associated with your organization:

Just-in-time provisioning is only allowed on reserved domains, and the domain (example.com) is not associated to your enterprise.

Keeper Security only accepts domains associated with your organization. Associate the domain in Keeper or use another email address.