Remote Support

Traditional remote access methods such as RDP, VPN, and legacy remote desktop tools lack granular access management controls. These processes enable easy exploits via stolen credentials and session hijacking. Extending remote access to your vendors makes matters even worse.

BeyondTrust Remote Support enables organizations to apply least privilege and audit controls to all remote access from employees, vendors, and service desks. BlokSec provides users the ability to securely connect without the hassle of passwords or MFA. Both representatives and public portals are supported.

Tip

BeyondTrust maintains their own version of this integration guide at docs.beyondtrust.com/rs/docs/bloksec.

---

BlokSec integration for representatives

Representatives authenticate to the BeyondTrust Remote Support console via SAML. Configuration is required in both BlokSec and BeyondTrust.

Prerequisites

• Installed BeyondTrust Remote Support instance
• Installed BlokSec instance
• BlokSec test users with mobile app installed

Setup

1. BlokSec setup

Create the application in BlokSec

Log in to BlokSec and follow the steps below.

1. From the dashboard, click + Add Application
2. Select Create from Template
3. Select the BeyondTrust Remote Support and Privileged Remote Access for Representatives template
4. On the Create Application screen:
   • Replace {your-instance-url} in the Entity ID and Assertion Consumer Service URLs with the URL of your BeyondTrust site (for example, eval######.beyondtrustcloud.com or your customer URL)
   • Set the NameID Source to User email
5. Edit the Groups attribute and set the Value to the group name to be passed with the SAML assertion
6. Submit the new application, then:
   • Note the SSO URI
   • View and save the X.509 Signing Certificate to a file (for example, signing_cert.pem)

2. BeyondTrust setup

Configure SAML for representatives in BeyondTrust

Log in to BeyondTrust Remote Support and follow the steps below.

1. Navigate to Users & Security → Security Providers, click + Add, and select SAML for Representatives
2. Under Identity Provider Settings:
   • Set Entity ID to https://api.bloksec.io
   • Set Single Sign-On Service URL to the SSO URI provided by BlokSec (for example, https://api.bloksec.io/sso/SingleSignOnService/{unique_ID})
   • Click + Upload Certificate and upload the X.509 signing certificate downloaded from BlokSec
3. Under Authorization Settings, choose the group to use for the Default Group Policy

Test the configuration

1. In the BlokSec admin console, navigate to the newly created BeyondTrust Remote Support for Representatives application
2. Click the settings icon and select Create Account
3. Go to your BeyondTrust instance’s login page (for example, https://eval######.beyondtrustcloud.com/login/login) and click Use SAML Authentication
4. Enter the username created in the previous step
5. BlokSec sends a push notification to the user’s mobile app
6. The representative reviews the request and approves it — the device performs a biometric authentication (fingerprint or facial recognition), and a digital signature is sent to BlokSec to verify the representative’s identity
7. The representative is securely logged in to the BeyondTrust Remote Support console

Test before rolling out

Verify the integration with a single representative account before disabling alternative authentication methods. Make sure the account has the BlokSec app installed and is fully provisioned.

---

BlokSec integration for public portals

Public portals can be configured to require SAML authentication via BlokSec, so that end users accessing the portal are authenticated passwordlessly before starting a support session.

Prerequisites

• Installed BeyondTrust Remote Support instance
• Installed BlokSec instance
• BlokSec test users with mobile app installed

Setup

1. BlokSec setup

Create the application in BlokSec

Log in to BlokSec and follow the steps below.

1. From the dashboard, click + Add Application
2. Select Create from Template
3. Select the BeyondTrust Remote Support Public Portal template
4. On the Create Application screen:
   • Replace {your-instance-url} in the Entity ID and Assertion Consumer Service URLs with the URL of your BeyondTrust site (for example, eval######.beyondtrustcloud.com or your customer URL)
   • Set the NameID Source to User email
5. Submit the new application, then:
   • Note the SSO URI
   • Save the X.509 Signing Certificate to a file (for example, signing_cert.pem)

2. BeyondTrust setup

Configure SAML for public portals in BeyondTrust

Log in to BeyondTrust Remote Support and follow the steps below.

1. Navigate to Users & Security → Security Providers, click + Add, and select SAML for Public Portals
2. Under Identity Provider Settings:
   • Set Entity ID to https://api.bloksec.io
   • Set Single Sign-On Service URL to the SSO URI provided by BlokSec (for example, https://api.bloksec.io/sso/SingleSignOnService/{unique_ID})
   • Click + Upload Certificate and upload the X.509 signing certificate downloaded from BlokSec

Require SAML authentication on the public portal

1. Navigate to Public Portals → Public Sites and edit the site you want to protect with BlokSec
2. Check the Require SAML Authentication box
3. Click Save

Test the configuration

1. In the BlokSec admin console, navigate to the newly created BeyondTrust Remote Support for Representatives application
2. Click the settings icon and select Create Account
3. Go to your BeyondTrust instance’s public site (for example, https://eval######.beyondtrustcloud.com) and click Login
4. Enter the username created in the previous step
5. BlokSec sends a push notification to the user’s mobile app
6. The user reviews the request and approves it — the device performs a biometric authentication (fingerprint or facial recognition), and a digital signature is sent to BlokSec to verify the user’s identity
7. The user is securely logged in to the BeyondTrust Remote Support portal

Test before rolling out

Verify the portal integration with a test account before enabling it for all users. Confirm that SAML authentication is required on the correct public site and that users can complete the full sign-in flow.