On Prisma Cloud, you can enable single sign-on (SSO) using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), such as Okta, Microsoft Active Directory Federation Services (ADFS), Azure Active Directory (AD), Google, or OneLogin. Prisma Cloud System Administrators can use the following APIs to configure tenant SSO.
openapi: 3.2.0
info:
title: Authentication and RBAC API's SSO API
contact:
name: Platform
url: https://panw-rnd.slack.com/archives/C01DQJBJ7LJ
version: '1.0'
description: On Prisma Cloud, you can enable single sign-on (SSO) using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), such as Okta, Microsoft Active Directory Federation Services (ADFS), Azure Active Directory (AD), Google, or OneLogin. Prisma Cloud System Administrators can use the following APIs to configure tenant SSO.
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
security:
- CertAuth: []
- ServiceJwt: []
- UserJwt: []
- x-redlock-auth: []
tags:
- name: SSO
description: On Prisma Cloud, you can enable single sign-on (SSO) using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), such as Okta, Microsoft Active Directory Federation Services (ADFS), Azure Active Directory (AD), Google, or OneLogin. Prisma Cloud System Administrators can use the following APIs to configure tenant SSO.
paths:
/authn/v1/saml/config:
get:
tags:
- SSO
summary: Get SAML Configuration
description: Used by System Admins to get the SAML Configuration for the tenancy
operationId: get-saml-config
responses:
'200':
description: Successful operation
content:
application/json:
schema:
$ref: '#/components/schemas/SsoConfig'
'401':
description: Authentication error
content:
application/json:
schema:
$ref: '#/components/schemas/SsoConfig'
'403':
description: Authorization error
content:
application/json:
schema:
$ref: '#/components/schemas/SsoConfig'
'429':
description: Too many requests
content:
application/json:
schema:
$ref: '#/components/schemas/SsoConfig'
security:
- x-redlock-auth: []
x-microservice: 'true'
x-public: 'true'
put:
tags:
- SSO
summary: Update SAML Configuration
description: Used by System Admins to update the SAML Configuration for the tenancy
operationId: update-saml-config
parameters:
- name: clientIp
in: header
required: false
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SsoConfig'
required: true
responses:
'200':
description: Successful operation
'400':
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/SpringErrorResponse'
'401':
description: Authentication error
'403':
description: Authorization error
'429':
description: Too many requests
security:
- x-redlock-auth: []
x-microservice: 'true'
x-public: 'true'
post:
tags:
- SSO
summary: Create SAML Configuration
description: Used by System Admins to create the SAML Configuration for the tenancy
operationId: create-saml-config
parameters:
- name: clientIp
in: header
required: false
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SsoConfig'
required: true
responses:
'200':
description: Successful operation
'400':
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/SpringErrorResponse'
'401':
description: Authentication error
'403':
description: Authorization error
'429':
description: Too many requests
security:
- x-redlock-auth: []
x-microservice: 'true'
x-public: 'true'
/authn/api/v1/oauth2/config:
get:
tags:
- SSO
summary: Get OIDC Configuration
description: Get the OAuth2 configuration details of a tenant that is used by OpenID Connect(OIDC).
operationId: get-oauth2-config
responses:
'200':
description: Successful operation
content:
application/json:
schema:
$ref: '#/components/schemas/OAuth2ConfigDetail'
'400':
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/SpringErrorResponse'
'401':
description: Authentication error
content:
application/json:
schema:
$ref: '#/components/schemas/OAuth2ConfigDetail'
'403':
description: Authorization error
content:
application/json:
schema:
$ref: '#/components/schemas/OAuth2ConfigDetail'
'429':
description: Too many requests
content:
application/json:
schema:
$ref: '#/components/schemas/OAuth2ConfigDetail'
security:
- x-redlock-auth: []
x-ga: 23.10.1
x-public: 'true'
put:
tags:
- SSO
summary: Update OIDC Configuration
description: Updates all the parameters of an existing OAuth2 configuration that is used by OpenID Connect(OIDC).
operationId: update-oauth2-config
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/OAuth2ConfigDetail'
required: true
responses:
'204':
description: Successful operation
'400':
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/SpringErrorResponse'
'401':
description: Authentication error
'403':
description: Authorization error
'429':
description: Too many requests
security:
- x-redlock-auth: []
x-ga: 23.10.1
x-public: 'true'
post:
tags:
- SSO
summary: Create an OIDC Configuration
description: Create an OAuth2 configuration for a given tenant to be used by OpenID Connect(OIDC).
operationId: create-oauth2-config
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/OAuth2ConfigDetail'
required: true
responses:
'201':
description: Successful operation
content:
application/json:
schema:
type: string
'400':
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/SpringErrorResponse'
'401':
description: Authentication error
content:
application/json:
schema:
type: string
'403':
description: Authorization error
content:
application/json:
schema:
type: string
'429':
description: Too many requests
content:
application/json:
schema:
type: string
security:
- x-redlock-auth: []
x-ga: 23.10.1
x-public: 'true'
patch:
tags:
- SSO
summary: Update OIDC Configuration Partially
description: Updates only the specified parameters of an existing OAuth2 configuration that is used by OpenID Connect(OIDC).
operationId: patch-oauth2-config
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/OAuth2ConfigDetail'
required: true
responses:
'204':
description: Successful operation
'400':
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/SpringErrorResponse'
'401':
description: Authentication error
'403':
description: Authorization error
'429':
description: Too many requests
security:
- x-redlock-auth: []
x-ga: 23.10.1
x-public: 'true'
/authn/api/v1/oauth2/login:
get:
tags:
- SSO
summary: Get OIDC Login URL
description: Get the OIDC login URL for the tenant.
operationId: get-oidc-login-url
parameters:
- name: user_name
in: query
description: User name requesting the login URL.
required: false
schema:
type: string
- name: prisma_id
in: query
description: Prisma ID for the tenant of the user requesting the login.
required: false
schema:
type: string
responses:
'200':
description: Successful operation
content:
application/json:
schema:
type: string
example:
url: https://prismacloud.io/authn/api/v1/oauth2/authorization/b5229d13-d2a2-4469-b9f8-1912cb11c2eb
'400':
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/SpringErrorResponse'
'429':
description: Too many requests
content:
application/json:
schema:
type: object
additionalProperties:
type: string
x-ga: 23.10.1
x-public: 'true'
security:
- x-redlock-auth: []
components:
schemas:
OAuth2ConfigDetail:
required:
- clientId
- idpAuthUri
- issuer
- scopes
- tokenUri
type: object
properties:
id:
type: string
description: Id
format: uuid
readOnly: true
prismaId:
type: integer
description: Prisma ID of the tenant.
format: int64
readOnly: true
clientId:
type: string
description: Client ID obtained after Identity Provider(IdP) configuration.
clientSecret:
type: string
description: Secret for the client id
writeOnly: true
issuer:
type: string
description: The identifier of the OpenID Connect(OIDC) provider.
scopes:
type: array
description: Identifiers used to specify what access privileges are being requested.
example: '[openid, email, profile]'
items:
type: string
description: Identifiers used to specify what access privileges are being requested.
example: '[openid, email, profile]'
grantType:
type: string
description: Grant types are a way to specify how a client wants to interact with an Identity Provider(IdP).
enum:
- authorization_code
withPkce:
type: boolean
description: Using proof key for code exchange(PKCE) as additional verification. PKCE ensures that only the client that requests the access token can redeem it.
enum:
- true
- false
idpAuthUri:
type: string
description: The URL of the authentication endpoint on the Identity Provider(IdP).
tokenUri:
type: string
description: The Identity Provider token endpoint URL for obtaining access and ID tokens.
jwkSetUri:
type: string
description: The URL of the Identity Provider(IdP) JSON Web Key Set document.This document contains signing keys that are used to validate the signatures from the provider.
endSessionUri:
type: string
description: The URL used to sign out the user from the Identity Provider(IdP).
isActive:
type: boolean
description: True to enable SSO using OIDC; False otherwise.
enum:
- true
- false
isJitEnabled:
type: boolean
description: Is JIT enabled
enum:
- true
- false
jitRoleClaimName:
type: string
description: Token claim providing the name of Prisma Cloud role for user.
jitDefaultRoleId:
type: string
description: Default Prisma Cloud role to use for JIT when claim is missing or undefined.
pcAuthUri:
type: string
description: Prisma Cloud endpoint URL to begin the authentication flow.
readOnly: true
pcRelayUri:
type: string
description: Prisma Cloud callback endpoint URL from the IdP during authentication.
readOnly: true
lastLoginErrors:
type: array
description: Recent OIDC login errors.
readOnly: true
items:
type: string
description: Recent OIDC login errors.
readOnly: true
createdBy:
type: string
description: User who created the resource.
readOnly: true
createdTs:
type: integer
description: Created on timestamp.
format: int64
readOnly: true
lastModifiedBy:
type: string
description: User who made the last update.
readOnly: true
lastModifiedTs:
type: integer
description: Last update timestamp.
format: int64
readOnly: true
clientSecretIsBlank:
type: boolean
description: True if client secret is not configured; False otherwise.
readOnly: true
enum:
- true
- false
SsoConfig:
type: object
properties:
identityProvider:
type: string
description: Identity Provider Issuer URI
certificate:
type: string
description: Identity Provider Certificate
enabled:
type: boolean
description: Is the configuration enabled?
default: false
logoutRedirectUrl:
type: string
description: Identity Provider Logout URL
relayStateParamName:
type: string
description: Identity Provider Relay State Param
lastLoginErrors:
type: array
description: Last Login Errors
readOnly: true
items:
type: string
description: Last Login Errors
readOnly: true
audienceUri:
type: string
description: Audience URI or Prisma Cloud SP-Entity-Id
readOnly: true
autoProvisionEnabled:
type: boolean
description: Enable JIT provisioning
default: false
requireAccessSamlUrlPublic:
type: boolean
description: Skip Public address check for Access SAML URL
default: true
autoProvisionSamlEmail:
type: string
description: JIT provisioning SAML Attribute - Email
autoProvisionSamlFirstName:
type: string
description: JIT provisioning SAML Attribute - First name
autoProvisionSamlLastName:
type: string
description: JIT provisioning SAML Attribute - Last name
autoProvisionSamlRole:
type: string
description: JIT provisioning SAML Attribute - Role
autoProvisionSamlTimezone:
type: string
description: JIT provisioning SAML Attribute - TZ
redLockAccessSamlUrl:
type: string
description: Identity Provider Configured Prisma Cloud Access URL
ErrorDetails:
required:
- message
- name
type: object
properties:
name:
type: string
message:
type: string
SpringErrorResponse:
required:
- error
- message
- path
- status
- timestamp
type: object
properties:
timestamp:
type: string
status:
type: integer
format: int32
error:
type: string
errorDetails:
type: array
items:
$ref: '#/components/schemas/ErrorDetails'
message:
type: string
path:
type: string
securitySchemes:
x-redlock-auth:
description: The x-redlock-auth value is a JSON Web Token (JWT).
in: header
name: x-redlock-auth
type: apiKey
externalDocs:
description: Platform Wiki Documentation
url: https://redlock.atlassian.net/wiki/spaces/RED/pages/2744877602/Platform+AuthN+Integration+Template