WatchGuard Account SSO Integration with Auth0

Deployment Overview

This document describes how to set up multi-factor authentication (MFA) for your WatchGuard accounts with Auth0 as an identity provider.

Contents

• WatchGuard Account SSO Integration with Auth0
• Deployment Overview
• Contents
• WatchGuard Account Authentication Data Flow with Auth0
• Before You Begin
• Configure Auth0
• Configure SSO for Your WatchGuard Account
• Test the Integration

WatchGuard Account Authentication Data Flow with Auth0

Auth0 communicates with various cloud-based services and service providers with SAML protocol. This diagram shows the data flow of an MFA transaction for WatchGuard Cloud.

Before You Begin

Before you begin these procedures, make sure that:

• You have a tier-1 WatchGuard Cloud account, and an operator with the Owner or Administrator role.
• A token is assigned to a user in Auth0.

Additional charges might apply to use Auth0.

Configure Auth0

Before you configure Auth0, you must copy the WatchGuard Service Provider SAML Metadata URL from the WatchGuard Account SSO Configuration Wizard.

To copy WatchGuard Service Provider SAML Metadata URL:

1. Log in to the WatchGuard Cloud with your WatchGuard user account credentials.
2. Select Administrator > SSO.
   The SAML SSO page opens.

3. Click Configure SAML SSO.
   The Important dialog box opens.

4. Click Continue.
   The WatchGuard Account SSO Configuration Wizard page opens.

5. In the WatchGuard Service Provider SAML Metadata text box, copy the WatchGuard Service Provider SAML Metadata URL.
6. To view the WatchGuard Service Provider SAML Metadata file, on a new tab on your web browser, enter the URL you copied in the previous step.
7. To save the WatchGuard Service Provider SAML metadata file to your local computer, right-click on the page, then select Save As.

   Keep the WatchGuard Account SSO Configuration Wizard page open. You need to complete the configuration on this page after the Auth0 configuration is complete.

To configure Auth0:

1. Log in to Auth0 with an administrator account.
2. Select User Management > Users.

3. Click + Create User.
   The Create User page opens.

   You must create the same user in WatchGuard Cloud.

4. In the Email text box, type your email address.
5. In the Password text box, type a password.
6. In the Repeat Password text box, type the password again.
7. Click Create.
   The User page opens.

8. Select Actions > Send Verification Email.
9. Click Confirm.
   An activation email message is sent to verify your email address.
10. Select Applications > Applications.

11. Click + Create Application.
    The Create Application page opens.

12. In the Name text box, type a name. In our example, we useWG App.
13. From the Choose An Application Type section, select Regular Web Applications.
14. Click Create.
    The Regular Web Application page opens.

15. Select the Addons tab.
16. Enable the SAML2 WEB APP option.
    The Addon: SAML2 Web App page opens.

17. Select the Usage tab.
    
18. To download the Auth0 metadata file, from the Identity Provider Metadatasection, click Download.
19. Select the Settings tab.
    The Settings page opens.

20. In the Application Callback URL text box, type or paste the value of the AssertionConsumerService Location parameter. You can copy this value from the WatchGuard Service Provider SAML Metadata file you saved in this section.
21. From the Settings section, uncomment the Audience line and change its value to the entityID value from the WatchGuard Service Provider SAML Metadata file you saved in this section.
22. Scroll down and uncomment the nameIdentifierFormat line.
23. Uncomment nameIdentifierProbes.
24. Uncomment the http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress claims under nameIdentifierProbes.

25. (Optional ) Click Debug.
    A confirmation message appears after the debug is successful.
26. Scroll down the page, then click Enable.
27. To close the page, in the upper right corner, click ×.
28. To enable Auth0 multi-factor authentication, select Security > Multi-factor Auth.
    The Multi-factor Authentication page opens.

29. From the Factors section, select Push Notification Using Auth0 Guardian.
    The Push Notification Using Auth0 Guardian page opens.

30. Select Push Notification using Auth0 Guardian.
31. Click Back to Multi-factor Authentication.
    The Define Policies page opens.

32. For Require Multi-factor Auth, select Always.
33. Click Save.
34. Click Continue.

Configure SSO for Your WatchGuard Account

To configure SSO for your WatchGuard account:

1. Go to the WatchGuard Account SSO Configuration Wizard page you opened in the Configure Auth0 section.

2. Click Select a Metadata File, then upload the Auth0 metadata file you downloaded in this section.
3. Click Next.
   The SAML Configuration options open.

4. In the IDP Name text box, enter a name to identify your identity provider. In our example, we name the IDP Auth0.
5. Keep the default values for all other settings.
6. To proceed through the Contact Information, Support Message, pages, click Next.
   The SSO Reference URLs page opens.

   The SSO reference URLs provide you with the direct links to the SSO log in pages for each account.

7. Click Save.
8. Click Back to WatchGuard Cloud.
9. Select > My Account.
10. Select SSO. Make sure the Enable SAML SSO toggle status is green.
11. To add the operators in WatchGuard Cloud, follow the steps in Add Operators to your Account. After you add an operator, make sure the Enable login with SAML SSO check box is selected.

To log in with SSO, you must have a WatchGuard Cloud Operator account and an Auth0 person account. Both accounts must have the same email address.
When you configure SAML SSO for your WatchGuard account, users can either log in with SSO or with their local user account. We recommend users log in with SSO so they do not have to re-authenticate after their initial login.

Test the Integration

To test Auth0 MFA with your WatchGuard Account, you can use push, SMS, email, one-time password, or a combination of different methods, and enable them across all users and applications.

In this example, we show the push notification using the Guardian method.

1. In a web browser, go to WatchGuard Cloud.
2. Click Log In With SSO.

4. In the IDP Name text box, type the IDP name.
5. Click Log In.
6. In the Email Address text box, type your email address.
7. In the Password text box, type your password.
8. Click Continue.
9. Approve the authentication request sent to your mobile device.
   You are logged in to WatchGuard Cloud.