Support for Applications that Run in Edge Chromium

Imprivata OneSign supports SSO for applications that run in Microsoft Edge Chromium.

Consider the following:

  • The Imprivata agent installer installs, but does not enable, an Imprivata OneSign SSO extension from the Chrome Web store.

    This extension is required for SSO to work with applications that are profiled in Edge Chromium.

  • After installing the Imprivata agent, you must enable the extension using a Microsoft Active Directory Group Policy Object (GPO).

    Per the Chrome Safe Browsing Policy, a GPO is the only supported way to enable extensions silently.

  • The SSO user experience is identical for applications that run in Internet Explorer, Google Chrome, and Edge Chromium.

NOTE: For more information on the minimum required version of Edge Chromium, see the Imprivata OneSign Supported Components matrix.

It is not necessary to create separate APG profiles for the same application in both Google Chrome and Edge Chromium:

  • You can create a single application profile using either Google Chrome or Edge Chromium, and deploy it to endpoints that are running either web browser.

  • Existing Google Chrome profiles are backward compatible with Edge Chromium.

    If an application was previously profiled using Google Chrome, it is not necessary to profile it again.

NOTE: The exception to the latter is an application that prompts for credentials with the Windows Security Authentication dialog. If an application prompts for credentials with this dialog, you must create separate profiles, as each browser launches the dialog differently.

Separate Chrome and Edge profiles are required for an application that prompts for credentials with the Windows Security Authentication dialog.

While you use the APG UIA probe to create each profile, you must add the 4 value to the AllowLearning registry key to learn the dialog in Edge Chromium.

To add the value:

  1. From the registry editor go "HKEY_LOCAL_MACHINE\SOFTWARE\SSOProvider\ISXAgent\AllowLearning".

  2. Configure 4 with a Data Type of REG_SZ and set the value to CredentialUIBroker.exe.

NOTE: Before deploying both profiles, create a shared credential store so your users do not have to repeat the credential capture process. For more information, see Using Shared Credential Stores.

While installing the Imprivata agent does not require an Internet connection, the endpoint must have one for Edge Chromium to acquire the extension from the Chrome Web store. Additionally, an Internet connection is required to receive any updates or upgrades to the extension through the Chrome Web store.

The Imprivata agent installs, but does not enable, a Chrome extension that is required for SSO.

Per the Chrome Safe Browsing policy:

  • A GPO is the only supported method for enabling the extension.

  • If you are unable to use a GPO, it must be manually enabled/allowed from each endpoint.

The following sections detail how to enable the Chrome extension object using a GPO:

Enabling the Chrome extension requires the following administrative template files:

  • msedge.admx

  • msedgeupdate.admx

  • msedge.adml

  • msedgeupdate.adml

Locate the Templates

To locate the templates:

  1. Microsoft makes the templates available for download here.

  2. Next to the controls that let you download Edge, click GET POLICY FILES.

  3. Extract the contents of the MicrosoftEdgePolicyTemplates cabinet file, and then extract the contents of the MicrosoftEdgePolicyTemplates zip.

  4. The templates are included in the Windows > admx folder:

    • The ADMX files are located at the root of this directory

    • The ADML files are located in the respective language folder.

      For example: en–US

Add the Templates to the Central Store on the Domain Controller

To add the administrative templates:

  1. Log into the domain controller.

  2. If the Group Policy Management Editor is open, close it.

  3. Go to C:\Windows\PolicieDefinitions.

  4. Copy msedge.admx, msedgeupdate.admx, and any required language folders.

    For example: en-US

  1. From the domain controller, open the Active Directory Users and Computers console.

  2. In the console tree, create an organizational unit (OU) for your endpoint computers.

  3. Add or move the required endpoint computers to the OU for testing.

  1. From the domain controller, open the Group Policy Management Console.

  2. In the required domain, select Group Policy Objects > New.

  3. In the New GPO window, name the GPO and click OK.

  4. Right-click the new GPO and select Edit. The Group Policy Management Editor opens.

  5. Go to Computer Configuration > Policies > Administrative Templates > Microsoft Edge > Extensions.

  6. In Extensions panel, double-click Extension Management Settings.

  7. Select Enabled, and open this file, and copy the JSON string.

  8. Paste the string into Extension management settings and remove any line breaks.

    The value must be on a single line without line breaks.

  9. Click OK, and close the Management editor.

  10. Link the GPO to the organizational units necessary for deployment.

To verify that the GPO has been applied to an endpoint:

  1. From an endpoint, open Windows Run, type rsop.msc, and press Enter.

  2. From the Resultant Set of Policy console, go to Computer Configuration > Administrative Templates > Microsoft, and select Extensions.

  3. In Extensions panel, double-click Extension Management Settings.

  4. Verify that the Chrome extension object is enabled.

If a GPO has not been applied, the first time users open Edge they are prompted to allow the extension.

The following screen capture is an example of what users see.

Click to enlarge.

Profiling an application for Edge Chromium is similar to the process for profiling web applications for Microsoft Internet Explorer.

Consider the following:

  • Applications must be profiled separately for Internet Explorer and Edge Chromium.

  • Applications do not need to be profiled separately for Edge Chromium and Google Chrome.

    A profile created in Edge Chromium can be deployed to an application that runs in Google Chrome, and vice versa.

    The exception to the latter is an application that prompts for credentials with the Windows Security Authentication dialog. If an application prompts for credentials with this dialog, you must create separate Edge and Chrome profiles, as each browser launches the dialog differently.

    For more information, see Profiling Applications that use the Windows Security Authentication Dialog.

  • Imprivata OneSign SSO does not support the following with Edge Chromium:

    • Java applets

    • Adobe Flash

  • If you profile an application for Edge Chromium that is already profiled for Internet Explorer, then create a shared credential store so your users do not have to repeat the credential capture process.

    For more information, see Using Shared Credential Stores.

  • Develop a simple naming system for your application profiles that includes the name of the application and its version. In the profile name, also include text to distinguish between Internet Explorer profiles and Chrome profiles.

  • Your Imprivata OneSign version and the type of application you want to profile determine whether you should open the Imprivata Admin Console and the Imprivata OneSign Application Profile Generator (APG) using Edge Chromium or Internet Explorer. In addition, to use Edge Chromium, a Chrome extension must be enabled. For details, see Application Profile Generator Support for Chrome and Edge Chromium.