SentinelOne - SAML integration

The following document refers to a SAML integration between SentinelOne and TrustBuilder MFA.

Prerequisites

• A SentinelOne console with administrator rights

• An TrustBuilder MFA service with administrator rights

Configuration

The configuration consists of an exchange of metadata between the SP (SentinelOne) and the IdP (TrustBuilder): each provides its metadata to the other. Then, it is necessary to make sure that TrustBuilder provides attributes that match with the attributes of the SentinelOne so that the authentication works.

Step 1: Create TrustBuilder SAML connector

1. Login to your TrustBuilder MFA administration console.

2. Go to the Secure Sites tab.

3. In the "connectors” section, click on Add a connector of type… and select SAML 2.0.

   

4. Name your connector.

5. Click on Add to create the connector.
   This will bring up the TrustBuilder (the Identity Provider) metadata.

6. Click on ”Download IdP SAML 2.0 certificate” to save TrustBuilder certificate. You will need it later in SentinelOne configuration.

7. Keep this connector window open. You will need to copy/paste the Issuer URL and Single Sign On URL to SentinelOne later in the configuration.

Step 2: SentinelOne configuration

1. Log into your SentinelOne account as an administrative user.

2. In the left menu sidebar, click on Settings. The "SETTINGS" page opens.

3. Click the INTEGRATIONS tab.

4. Under "Types", click on SSO.

5. Click the Enable SSO toggle switch.

6. Enter your domain name into the Domain Name field.

   

7. Copy the following URL from TrustBuilder connector and paste them into SentinelOne: the IssuerURL into IssuerID field and the Single Sign On URL into IDP redirect URL field.

   

   

8. Under "IDP public certificate", click on Upload. Select the TrustBuilder certificate file downloaded in TrustBuilder connector.

   

9. Keep this configuration window open.
   You will need the Assertion Consumer Service URL, the Single Sign On URL and the Signature Certificate to generate SentinelOne metadata (SP metadata).

You will come back later to finalize the configuration.

Step 3: Generate SentinelOne (SP) metadata

To allow SentinelOne and TrustBuilder to communicate, you should generate SentinelOne (the SP) metadata and provide them to TrustBuilder (the IdP).

You can download and modify the following XML file example to match your environment. → Download the SP metadata sample file

Make sure to configure: EntityID, Assertion Consumer Service and X509Certificate. These information can be copied from the SentinelOne configuration (see Step2).

Step 4: Finalize TrustBuilder SAML connector

1. In TrustBuilder SAML 2.0 connector, paste the SentinelOne (SP) metadata.

   

2. Click on Update to save the configuration and unlock the remaining parameters.

3. Configure SAML Attributes to match with the attributes in SentinelOne.
   In our example, SentinelOne uses the Mail attribute for authentication.

   

4. Click on Update to save the configuration.

5. If not automatically created, add the Secure Site associated to the connector (Secure Sites tab > Add a Secure Site of type … > Select your connector’s name).

   

   The Called URL setting is only used to set a bookmark for the user on their self service portal, it has no impact on the security.

Step 5: Finalize the SentinelOne configuration

1. In SentinelOne configuration, click on Test.
   You should be redirected to TrustBuilder webpage for authentication

2. Click on Save on the SentinelOne configuration page.