Support for Applications that Run in Google Chrome

Imprivata OneSign supports SSO for applications that run in Google Chrome. Consider the following:

  • The Imprivata agent installer installs, but does not enable, an Imprivata OneSign SSO extension from the Chrome Web store. This extension is required for SSO to work with applications that are profiled in Chrome.

    After installing the Imprivata agent, you must enable the extension using a Microsoft Active Directory Group Policy Object (GPO). Per the Chrome Safe Browsing Policy, a GPO is the only supported way to enable extensions silently.

  • Profiling an application for Chrome is similar to the process for profiling web applications for Microsoft Internet Explorer.

  • The SSO user experience is identical for applications that run in Internet Explorer and Chrome.

NOTE: For more information on the minimum required version of Chrome, see the Imprivata OneSign Supported Components matrix.

It is not necessary to create separate APG profiles for the same application in both Google Chrome and Edge Chromium:

  • You can create a single application profile using either Google Chrome or Edge Chromium, and deploy it to endpoints that are running either web browser.

  • Existing Google Chrome profiles are backward compatible with Edge Chromium.

    If an application was previously profiled using Google Chrome, it is not necessary to profile it again.

NOTE: The exception to the latter is an application that prompts for credentials with the Windows Security Authentication dialog. If an application prompts for credentials with this dialog, you must create separate profiles, as each browser launches the dialog differently.

For more information, see Profiling Applications that use the Windows Security Authentication Dialog.

While installing the Imprivata agent does not require an Internet connection, the endpoint must have one for Chrome to acquire the extension from the Chrome Web store. Additionally, an Internet connection is required to receive any updates or upgrades to the extension through the Chrome Web store.

The Imprivata agent installs, but does not enable, a Chrome extension that is required for SSO.

Per the Chrome Safe Browsing policy:

  • A GPO is the only supported method for enabling the extension.

  • If you are unable to use a GPO, it must be manually enabled/allowed from each endpoint.

The following sections detail how to enable the Chrome extension object using a GPO:

Enabling the Chrome extension requires the following administrative template files:

  • chrome.admx

  • google.admx

  • chrome.adml

  • google.adml

Locate the Templates

To locate the templates:

  1. Google makes the templates available for download here.

  2. Under the Step 2: Update Your Group policies section, click download the latest policy template.

  3. Extract the contents of policy_templates zip.

  4. The templates are included in the Windows > admx folder:

    • The ADMX files are located at the root of this directory

    • The ADML files are located in the respective language folder.

      For example: en–US

Add the Templates to the Central Store on the Domain Controller

To add the administrative templates:

  1. Log into the domain controller.

  2. If the Group Policy Management Editor is open, close it.

  3. Go to C:\Windows\SYSVOL\domain\Policies, and if it does not exist, create a PolicyDefinitions folder to function as the Central Store.

  4. In PolicyDefinitions, copy chrome.admx, google.admx, and any required language folders.

    For example: en-US

  1. From the domain controller, open the Active Directory Users and Computers console.

  2. In the console tree, create an organizational unit (OU) for your endpoint computers.

  3. Add or move the required endpoint computers to the OU for testing.

  1. From the domain controller, open the Group Policy Management Console.

  2. In the required domain, select Group Policy Objects > New.

  3. In the New GPO window, name the GPO and click OK.

  4. Right-click the new GPO and select Edit. The Group Policy Management Editor opens.

  5. Go to Computer Configuration >Policies > Administrative Templates > Google > Google Chrome > Extensions.

  6. In Extensions panel, double-click Extension Management Settings.

  7. Select Enabled, and open this file, and copy the JSON string.

  8. Paste the string into Extension management settings and remove any line breaks.

    The value must be on a single line without line breaks.

  9. Click OK, and close the Management editor.

  10. Link the GPO to the organizational units necessary for deployment.

To verify that the GPO has been applied to an endpoint:

  1. From an endpoint, open Windows Run, type rsop.msc, and press Enter.

  2. From the Resultant Set of Policy console, go to Computer Configuration > Administrative Templates > Google > Google Chrome, and select Extensions.

  3. In Extensions panel, double-click Extension Management Settings.
  4. Verify that the Chrome extension object is enabled.

If a GPO has not been applied, the first time users open Chrome they are prompted to allow the extension.

The following screen capture is an example of what users see.

Click to enlarge.

  • Applications must be profiled separately for Internet Explorer and Chrome.

  • Applications do not need to be profiled separately for Edge Chromium and Google Chrome.

    A profile created in Google Chrome can be deployed to an application that runs in Edge Chromium, and vice versa.

    The exception to the latter is an application that prompts for credentials with the Windows Security Authentication dialog. If an application prompts for credentials with this dialog, you must create separate Edge and Chrome profiles, as each browser launches the dialog differently.

    For more information, see Profiling Applications that use the Windows Security Authentication Dialog.

  • Imprivata OneSign SSO does not support the following with Chrome:

    • Java applets

    • Adobe Flash

    • Chrome applications

  • If you profile an application for Chrome that is already profiled for Internet Explorer, then create a shared credential store so your users do not have to repeat the credential capture process.

    For more information, see Using Shared Credential Stores.

  • Develop a simple naming system for your application profiles that includes the name of the application and its version. In the profile name, also include text to distinguish between Internet Explorer profiles and Chrome profiles.

  • Your Imprivata OneSign version and the type of application you want to profile determine whether you should open the Imprivata Admin Console and the Imprivata OneSign Application Profile Generator (APG) using Chrome or Internet Explorer. In addition, to use Chrome, a Chrome extension must be enabled. For details, see Application Profile Generator Support for Chrome and Edge Chromium.