Skip to content
IAM built for the AI-Era
Logo

Thales SafeNet Trusted Access

Thales SafeNet Trusted Access is a cloud-based access management service that provides multi-factor authentication (MFA), single sign-on (SSO), and policy-based access to applications.

Configuring Thales SafeNet Trusted Access with Specops Authentication allows users to verify their identity through SafeNet Trusted Access. The integration uses a customer-configured OpenID Connect (OIDC) application. Each customer supplies the full discovery URL, client ID, and client secret for their own Thales application.

Users authenticate according to the authentication policies configured for the application in SafeNet Trusted Access. You can automatically enroll directory users or let users enroll manually.

Prerequisites

Before configuring the identity service, you need:

  • Administrator access to Specops Authentication Web.
  • Access to the SafeNet Trusted Access Access Management console with permissions to create and configure applications.
  • Users configured in SafeNet Trusted Access who can complete the application's authentication requirements.
  • For automatic enrollment, directory users synchronized to SafeNet Trusted Access with their User Object GUID available for claim mapping. The GUID must belong to the same user account that the user signs in with in Specops Authentication. See How enrollment works.

The discovery URL and all endpoints listed in the discovery document must use publicly accessible HTTPS hosts. Private addresses, loopback addresses, literal IP addresses, and other non-public endpoints are rejected.

Note

Use the connection values from your own Thales application and the callback URL from your Specops Authentication environment. The client ID and client secret must belong to the same Thales application.

Copy the callback URL from Specops Authentication

  1. Log in to Specops Authentication Web.
  2. Go to Identity Services, then select Thales SafeNet Trusted Access.
  3. If the identity service is disabled, click Enable.
  4. Copy the value shown in the Callback URL field. You will paste this into the Thales application.

Note

The same callback URL is used for authentication and manual enrollment. Copy the complete URL exactly as displayed, including its path and capitalization.

Configure an application in SafeNet Trusted Access

For additional provider-side instructions, see Thales' documentation on OIDC applications and custom OIDC applications.

Creating the application

  1. In the SafeNet Trusted Access console, go to Applications and click Add Application (the plus icon).
  2. Search for Generic Template and select it using the plus icon.
  3. Enter a Display Name, for example Specops Authentication.
  4. Set Integration Protocol to OIDC and Access Type to Confidential, then click Add.
  5. On the application's Configure tab, under Step 01: Generic Template Setup, copy the following values for use in Specops Authentication:
    • CLIENT ID
    • CLIENT SECRET
    • WELL KNOWN CONFIGURATION URL

Configuring the authentication flow

  1. Continue to Step 02: STA Setup.
  2. Under ALLOWED FLOW TYPE, select Authorization Code.
  3. For PROOF KEY FOR CODE EXCHANGE CODE CHALLENGE METHOD, select Client defined to allow Specops Authentication to specify S256 as the PKCE challenge method.
  4. In VALID REDIRECT URL, paste the complete Callback URL copied from Specops Authentication.
  5. Set REQUEST SIGNATURE ALGORITHM to none.

Adding the User Object GUID claim for automatic enrollment

If you use automatic enrollment, add a claim that links the synchronized Thales user to the same directory account in Specops Authentication. For manual enrollment using the standard sub claim, skip this section. See How enrollment works.

  1. In the SafeNet Trusted Access console, open the application's Configure tab. Under Step 02: STA Setup > User Identity Claims, click Add Claim.
  2. In NAME, enter a name for the claim that will contain the user's directory object GUID, for example object_guid or directory_object_guid. You can choose your own name, but you must enter the same name in Claim containing User Object GUID in Specops Authentication.
  3. In VALUE, select User Object GUID.

  4. Make a note of the claim name.

    Note

    The claim must be included in the signed ID token. A missing, empty, or malformed GUID prevents authentication or enrollment from completing when this claim is configured.

Assign the application to users

Complete these steps for both automatic and manual enrollment.

  1. On the Configure tab, click Save Configuration.
  2. Go to the Assign tab.
  3. Assign the application to all users or to the user groups that will use it, then save the assignment.

Configure Thales SafeNet Trusted Access in Specops Authentication

  1. In Specops Authentication Web, go to Identity Services, then select Thales SafeNet Trusted Access.
  2. In Well Known Configuration URL, paste the full WELL KNOWN CONFIGURATION URL copied from the Thales application.
  3. In Client ID, paste the application's CLIENT ID.
  4. In Client secret, paste the application's CLIENT SECRET.

  5. In the Automatically enroll users drop-down, select:

    • No: Users must enroll manually before they can authenticate with Thales.
    • Yes: Automatically enroll on-premises Active Directory and Microsoft Entra ID users when SafeNet Trusted Access and Specops Authentication use the same directory identifier for each user. Configure the GUID claim in the next field.

    See How enrollment works.

  6. In Claim containing User Object GUID:

    • If Automatically enroll users is Yes, enter the claim name configured in Thales, for example object_guid. This must match the name of the claim mapped to User Object GUID in the Thales application. The claim name must not be sub.
    • If Automatically enroll users is No, leave the field empty to use the standard OIDC sub claim for manual enrollment. The User Object GUID claim is then not required in Thales. If you enter a claim name, manual enrollment uses that claim instead.
  7. Click Save.
  8. Click Test connection to validate the OIDC configuration. See Verify the configuration.

How enrollment works

Automatic enrollment makes Thales available to on-premises Active Directory and Microsoft Entra ID users without a manual enrollment step. This is useful when you have synchronized your directory to Thales.

Automatic enrollment requires a configured GUID claim name. The GUID must belong to the same user account that the user signs in with in Specops Authentication. Automatic enrollment cannot be enabled when the claim name is empty or sub.

The required identifier depends on the directory that supplies the user to Specops Authentication:

  • On-premises Active Directory: The user's Active Directory objectGUID.
  • Microsoft Entra ID: The user's Microsoft Entra ID object ID.

Note

A user's on-premises Active Directory objectGUID differs from their Microsoft Entra ID object ID. If SafeNet Trusted Access is synchronized from on-premises Active Directory while Specops Authentication users come from Microsoft Entra ID, a claim containing the on-premises objectGUID will not match. The claim must contain the Entra ID object ID for automatic enrollment to work. Verify that the SafeNet synchronization and claim mapping supply this identifier before enabling automatic enrollment.

If a GUID claim name is configured, both authentication and manual enrollment use that claim, even when Automatically enroll users is No. To use sub for manual enrollment, leave the claim name empty.

A saved manual enrollment takes precedence over automatic enrollment. Removing the manual enrollment makes the automatic enrollment available again if automatic enrollment is enabled.

Verify the configuration

Note

Test connection validates the discovery document, endpoints, supported OIDC features, and signing keys. Client credentials are verified when a user authenticates. The connection test cannot verify that a user's ID token contains the configured claim or that its value matches the intended directory user.

Before making the identity service available to users:

  1. Run Test connection and resolve any configuration or connectivity errors.
  2. Use a test user assigned to the Thales application to complete authentication.
  3. If using automatic enrollment, verify that a user can log in.

Logout and broader single sign-on behavior are outside the scope of this integration.