Add your own identity provider to Reveal(x) 360

1. Log into Reveal(x) 360.
2. Click System Settings at the top right of the page and then click All Administration.
3. Click User Access.
4. Note the Assertion Consumer Service (ACS) URL and Entity ID, which you will paste into your IdP configuration.
5. Paste the ACS URL from Reveal(x) 360 into the ACS URL field on your IdP.
6. Paste the SP Entity ID from Reveal(x) 360 into the SP Entity ID field on your IdP.

You must configure attributes on your IdP that identify the user throughout the ExtraHop system by their first name, last name, and email address. Refer to your identity provider documentation for the correct property names when mapping these attributes or attribute statements.

1. In the application attribute mapping section, add three attributes.
2. In the first attribute, select email or similar. (For example, in Okta, this attribute is called user.email.)
3. For the Service Provider, paste the following string: urn:oid:0.9.2342.19200300.100.1.3
4. In the second attribute, select last name or similar. (For example, in Okta, this attribute is called user.lastName.)
5. For the Service Provider, paste the following string: urn:oid:2.5.4.4
6. In the third attribute, select first name or similar. (For example, in Okta, this attribute is called user.firstName.)
7. For the Service Provider, paste the following string: urn:oid:2.5.4.42

You must configure attributes on your identity provider to grant users access to the ExtraHop system. You can type any name for these attributes, but they must match what you configure later in Reveal(x) 360.

1. In the application attribute mapping section, add four attributes.
2. In the first attribute, select custom or similar and type a descriptive name for user privileges, such as writelevel.
3. For the Service Provider, type a descriptive term to identify the attribute in Reveal(x) 360, such as write.
4. In the second attribute, select custom or similar and type a descriptive name for packet access, such as packetslevel.
5. For the Service Provider, type a descriptive term to identify the attribute in Reveal(x) 360, such as packets.
6. In the third attribute, select custom or similar and type a descriptive name for NDR module access, such as ndrlevel.
7. For the Service Provider, type a descriptive term to identify the attribute in Reveal(x) 360, such as ndr.
8. In the fourth attribute, select custom or similar and type a descriptive name for NPM module access, such as npmlevel.
9. For the Service Provider, type a descriptive term to identify the attribute in Reveal(x) 360, such as npm.
10. Save the settings and then export the application metadata XML file.

1. In Reveal(x) 360, on the User Access page, click Add Identity Provider.
2. In the Provider Name field, type a name to identify your specific identity provider. This name appears on the ExtraHop system log in page.
   The name must meet the following guidelines:

   • Must only include periods, hyphens, and alphanumberic characters
   • Must be between 3 and 32 characters in length
3. Open the metadata file you exported in the previous procedure, and then copy and paste the contents into the Provider Metadata (XML) field.
4. Scroll to the User Privilege Attributes section. There are three sections, one for each of the access types.
5. In the Attribute Name field, type the name you configured on your IdP for user privilege access.
6. In our example above, we specified write. In the Attribute Values fields, type the names of the privilege levels you identified for your users. In the figure below, we specified Full Write for the Full write privileges value.

   Important:

   You must specify the Attribute Name and configure at least one attribute value other than None to enable users to log in.

   
   
   
7. Scroll to the Packets and Session Key Access section.
   Configuring packets and session key attributes is optional and is only required if you have a connected packetstore. If you do not have a packetstore, type NA in the Attribute Name field and leave the Attribute Value fields blank.
8. In the Attribute Name field, type the name you configured on your IdP for packets access. In our example above, we specified packets.
9. In the Attribute Values fields, type the names of the privilege levels you created for your users. In the figure below, we specified None.
   
   
   
10. Scroll to the NDR Module Access section.
    Configure the NDR module access attribute if you want users to have access to security detections and workflows. Otherwise, type NA in the Attribute Name field and leave the Attribute Values fields blank.
11. In the Attribute Name field, type the name you configured on your IdP for NDR module access. In our example above, we specified ndrlevel.
12. In the Attribute Values fields, type the names of the privilege levels you created for your users. In the figure below, we specified Full.
    
13. Scroll to the NPM Module Access section.
    Configure the NPM module access attribute if you want users to have access to performance detections and workflows. Otherwise, type NA in the Attribute Name field and leave the Attribute Values fields blank.
14. In the Attribute Name field, type the name you configured on your IdP for NPM module access. In our example above, we specified npmlevel.
15. In the Attribute Values fields, type the names of the privilege levels you created for your users. In the figure below, we specified Full.
    
16. Click Save. It can take up to two minutes for the IdP configuration to be saved and enabled on the system.

You can now add system access attributes and their associated privilege levels to your existing users. You can assign multiple privileges to a user, but the user is always granted the highest privilege when they log in to the system.

1. In your IdP, select the user you want to grant privileges to.
2. Add an attribute for the type of access you previously defined, such as writelevel.
3. In the same row, add the name you specified for the privilege level, such as Full Write.

The following figure shows an example of these attributes in JumpCloud:

Users appear on the Users page in Reveal(x) 360 after they log in the first time. If a user does not appear in the table, they are not successfully being authenticated and authorized. Contact ExtraHop Support if you need assistance.

1. Log in to Reveal(x) 360.
2. Click System Settings at the top right of the page and then click All Administration.
3. Click User Access. Users that successfully log in to the system appear in the table on the Users page in Reveal(x) 360. The table displays the name of the identity provider and the assigned privileges for each user.
4. Click on a user name to see user details or to delete the user from the system.

   Important:

   When you delete a user, you must also revoke user access to the ExtraHop System through your IdP. Otherwise, the user might be able to log in again.

When you make changes to your identity provider configuration, for example, regenerating the IdP certificate, you must export the new metadata XML file and update the identity provider settings on Reveal(x) 360.

1. Log in to your identity provider.
2. Select the ExtraHop application on your identity provider and export the updated metadata XML file.
3. Open the XML file in a text editor and copy the contents.
4. Log in to Reveal(x) 360 with a user account that has System and access administration privileges.
5. Click the System Settings icon and then click User Access.
6. In the SAML Configuration section, click Edit Identity Provider.
7. Paste the contents of the XML file into the Provider Metadata XML field.
8. Click Save.

   Important:

   All active users will be logged out after saving the updated configuration.