Requirements
- Full Admin user role. For more information, see Manage Accounts.
- Provision users and groups from your organization in Secure Access. The users and groups must match the identities obtained from SAML. For more information, see Manage Users and Groups.
- Download your IdP SAML metadata file in XML format.
- The SAML metadata must have a signing key.
- Configure SAML with an identity provider (IdP) that supports SAML 2.0 POST profiles.
- Ensure that traffic to your IdP URL is bypassed on the SWG to avoid an authentication loop. For more information, see Manage Domains.
- Enable cookies for your browser. For more information, see your browser's documentation.
- Install the Cisco Secure Access root certificate on all client machines egressing from networks or network tunnels where SAML is enabled. For more information, see Manage Certificates.
- If you use AD FS for SAML, we recommend that you bypass web traffic to the id.sse.cisco.com domain on the Secure Access secure web gateway (SWG). For other IdPs, send id.sse.cisco.com requests to the SWG, not directly to the internet. For more information about bypassing domains and Secure Access Web security, see Manage Domains.