Steve The Identity Guy

In this blog we are going to walk through the configuration of using HYPR Passwordless Authentication with Workspace ONE Access. HYPR can be integrated with Workspace ONE as a primary authentication method or as a second factor of authentication. Hypr can be integrated with Workspace ONE Access using either SAML, OIDC, or Radius. In this blog, we are going to focus on the SAML Integration.

Lets start by downloading our Workspace ONE Access metadata.

Download Workspace ONE Access Metadata

1. Log into the Workspace ONE Access Admin Console
2. Go to Catalog -> Web Apps
3. Click on the settings button.
4. Click on the Service Provider (SP) metdata and download a copy to your local file system.

Create a New Client in HYPR

1. In your HYPR Keycloak Admin Console, go to Clients -> Create

2. Under import, click select file and choose your Workspace ONE Access Metadata that you previously downloaded.
3. The Client ID and Protocol should be automatically populated

4. Click Save
5. Edit the client you just created.
6. Ensure that the correct Login Theme is selected
7. Select RSA_SHA256 for the Signature Algorithm

8. Ensure that the Name ID format is using the correct attribute to properly map to users in Workspace ONE Access.
9. Click Save

10. Download your IdP Metadata by going to https://{hyprserver}/auth/realms/{realm}/protocol/saml/descriptor

Create your 3rd Party IDP in Workspace ONE Access

1. In the Workspace ONE Access Admin Console, go to Identity & Access Management-> Identity Providers
2. Click on Add Identity Provider -> Create SAML IDP

3. Provide a Name for this Identity Provider ie. HYPR
4. Paste the IdP Metadata that was previously downloaded into the space provided.
5. Click Process Metadata

6. Select the Name ID Format “urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified”
7. Select username for the value. Note: If you are mapping to a different attribute, select the appropriate value per your environment.

8. Under Users, select the correct directory that will be used to match users from the assertion sent from Hypr:

9. Select All Ranges
10. Under Auth Methods, provide a unique name for this Authentication ie. HYRP-Passwordlesss
11. Select “urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport” as the SAML Context.

12. Click Add

Set up your Access Policy

In this example, we are going to use HYPR as a fallback authentication mechanism to Certificate Based Authentication. In my environment, all my managed devices will use Certificate Based Authentication or Mobile SSO with Device Compliance. For my unmanaged devices, I’m going to provide a fallback to Hypr for Authentication.

1. In Identity & Access Management -> Policies
2. Edit your default policy.
3. Edit your Windows 10 and/or MacOS Policy
4. Add HYPR as a Fallback to allow for managed devices

5. Click Save,
6. Click Next
7. Click Save

Note: If you want to use HYPR as a second factor of authentication, you can add it along with Mobile SSO or Certificate Based Authentication

The one thing to be aware of is that HYPR can not currently support accepting usernames in the SAML Authentication request. This provides a less than ideal solution where the user has to enter a username when redirected to HYPR. The user will get an error in Workspace ONE Access if they authenticate with a different username than expected.

Testing the flow

1. Access your HYPR Device Manager in your browser, click Add Device

2. Select Smartphone and Scan the provided barcode with your HYPR App
3. Now Log into Workspace ONE Access
4. You should be redirected to HYPR

5. Enter your username and select Smartphone
6. You should get a notification on your device

7. Click OK and complete the biometric challenge.
8. You should now be successfully authenticated into Workspace ONE Access.