If SSO is enabled in a Vault, do all users need to use it?
Whether a user accesses Vault using login credentials or using SSO depends on the Security Policy set for the user. You may configure a Vault so that some users use SSO and others do not. This ability is useful if you grant user accounts to people outside your organization (for example, ad agencies or auditors). With SAML, you may also add an Identity Provider button to your login page, providing users with login options.
Vault has a restriction to prevent users who sign in with IdP-initiated SSO from providing eSignatures. See details below.
What happens to audit trail tracking for logins?
Anytime a user navigates to your Vault and is automatically logged in via SSO, the activity triggers a new user login item in the audit trail.
Can a user profile use both SAML and OAuth 2.0 /OpenID Connect?
Yes. The security policy associated to a user can have up to one SAML and one OAuth 2.0 / OpenID Connect profile.
SAML FAQ
Does Vault support two-factor or multi-factor authentication with SAML accounts?
Vault does not support two-factor or multi-factor authentication on Single Sign-on accounts. Users can configure two-factor and multi-factor authentication through their SAML Identity Provider system.
How difficult is it to implement SAML with Vault?
If your company already has SAML 2.0 in place with other cloud applications, it should not be difficult. If you have no prior experience with SAML and cloud applications, it will take time to establish the general infrastructure and gain familiarity with SAML and IdP configuration.
Can SAML be used to integrate Vault & Veeva CRM?
Yes. You can configure the Veeva CRM org to be a SAML IdP, or use an external IdP with both Veeva CRM & Vault as SPs. Alternately, you can use delegated authentication.
Can SAML be used with the Vault API?
Yes. For more information, see the Vault Developer Portal.
What types of authentication does SAML support?
We recommend that you use forms-based authentication. When using Kerberos or NTLM authentication, some browsers and clients may forward cached authentication sessions rather than prompting users for re-authentication during eSignature tasks.
What type of TLS integration does SAML support?
We support TLS versions 1.3 and 1.2.
How do session timeouts interact between the IdP and Vault?
When using SSO, we recommend that you configure the same session duration for your Vault and your identity provider. If the Vault’s session duration is longer, Vault only considers its active session and does not automatically log users out when the IdP session expires. If the Vault’s session duration is shorter, Vault may log the user out, but the browser will typically redirect back to the IdP and the IdP will either start a new Vault session or prompt the user to login again.
How does eSignature work with SAML?
Our eSignature approach prompts the user to re-enter their username and password. eSignature is only available with SSO using the SP-initiated SAML model. When SSO users try to complete an eSignature task, Vault loads the identity provider’s login page and asks users to re-authenticate there. There are no additional steps in Vault to complete the task.
Note: When configuring your identity provider, verify that the setting to force authentication on each SAML request is on. For example, using Okta’s Template SAML 2.0, you must select the Force Authentication checkbox. When using a template from your identity provider, be sure to use a SAML 2.0 template
Some browsers prevent users from completing eSignatures with their SAML Identity Providers through an iFrame. You can avoid this issue by enabling third-party cookies and adding *.veevavault.com domain to a list of trusted domains. Alternatively, you can configure the eSignature flow to complete through a pop-up by selecting the Authenticate SAML eSignatures in a pop-up window rather than an iFrame checkbox.
Note: eSignature Authentication requires SP-Initiated SAML mode.
Why do eSignatures open a pop-up when the “Authenticate SAML eSignatures in a pop-up window rather than an iFrame” setting is off?
The Authenticate SAML eSignatures in a pop-up window rather than an iFrame setting only applies to document eSignatures. When providing an eSignature on an object record, users will always see a pop-up window.
What is the difference between a Single Sign-on Profile and an eSignature Profile?
The Single Sign-on Profile is required for SSO login. The eSignature Profile is optional, used specifically for electronically signing documents and object records via SAML. If no eSignature Profile is configured in a Security Policy, the Single Sign-on Profile is used for both SSO login and eSignature. One Single Sign-on Profile and one eSignature Profile can be associated with the same Security Policy.
OAuth2.0 / OpenID Connect FAQ
What kind of infrastructure is required to implement OAuth2 / OIDC with Vault?
Vault supports OpenID Connect with PingFederate Authorization Servers only. Vault can consume the access tokens to issue Vault Session IDs. It is further recommended that your client and AS supports and implements PKCE.
Can OAuth2 / OIDC Connect be used to log in to Vault UI?
No. OAuth / OIDC is available for API level authentication only at this time. For more information, see the Vault Developer Portal.
Does my Vault Session ID expire when the access token expires?
Once a Vault Session ID is issued, it follows the Vault session duration configuration and not the token expiration specified by the AS. This means the AS access token may expire before the Vault Session ID. When Vault Session ID expires, you must request new one using your AS access token.