Configure Locker SSO for Epic Rover, Haiku and Canto

Validate Epic Rover, Haiku, and/or Canto settings in the Imprivata Admin Console:

Imprivata Services will enter the Enterprise ID and one-time cloud provisioning code required to establish trust between your Imprivata enterprise and the Imprivata cloud:

1. In the Imprivata Admin Console, click the gear icon > Cloud connection.

2. Services will enter your Enterprise ID and cloud provisioning code. (The cloud provisioning code expires 5 minutes after it's generated. Generate a new code if 5 minutes has elapsed.)

3. Click Establish trust.

   IMPORTANT:

   The cloud connection must be established by Imprivata Services.

Imprivata SSO (IdP) and Epic need metadata from each other.

Open both applications at the same time to gather and share the following metadata:

A full list of required inputs needed for Epic’s side of the configuration can be found in step 2.2 in the Sherlock checklist 1975.

From Epic, obtain:

1. In the Imprivata Admin Console, go to Applications > Single sign-on application profiles.

   All Single sign-on application profiles, including Mobile app profiles and OpenID Connect application profiles, are managed from this page.

2. Click Add App Profile > Application using OpenID Connect. The Add application using OpenID Connect page opens.

3. In the Application profile name box, type Epic Rover as the application profile name. This name is only visible to administrators.

4. In the Application user-friendly name box, type Rover as the user-friendly name for the application. This is the application name your users will see when they log in.

5. In the Redirect URIs box, type the Redirect URI for Epic.

   com.epic.rover.oidc://callback)

6. In the Claims section, for Epic Rover, leave the default values. These include:

   Scope	Claim name	Attribute Mapping	ID token	Access token
   Profile (required by Epic)	name	User logon name – Pre W2K (SAMAccount)	checked	unchecked
   	given_name	First name (givenName)	checked	unchecked
   	family_name	Last name (surname)	checked	unchecked
   	upn	User logon name (userPrincipalName)	checked	unchecked
   Email	email	Email address (mail)	checked	unchecked

   Profile is a required scope to configure on the Epic side.

   Name is used in the username claim in the User ID Mapping record.

   UPN is used in the Token ID claim field in the User ID Mapping record.

7. In the Client credentials section:

   1. Click Generate Client credentials to provide to Epic. A Client ID and Client secret are created.

   2. Securely provide the Client ID and Client to your organization's Epic ECSA who will need to configure Epic Rover to use OIDC.

   3. Conditional - Select Public client to work with public OIDC clients. By default, all OIDC profiles are confidential.
      IMPORTANT:

      Public clients are less secure because they run in environments where secrets cannot be reliably protected. Use with caution.

8. Click View and copy Imprivata (IdP) OpenID Connect metadata.

   1. Copy the Issuer URL. Provide the Issuer URL value to your Epic TS. They will generate a new econfig URL* or modify the existing one. This will include the authorization endpoint and the token endpoints that Epic needs.

      NOTE:

      Ensure that the econfig URL is an internal URL for the customer organization.

9. Click Save.

In your MDM, create and deploy an SSO Extension that enables single sign-on.

1. In your MDM's admin console, create an SSO extension profile with the following information:

   1. Give the profile a unique, identifiable name, such as 'Imprivata Locker SSO Extension'.

   1. Extension identifier: com.imprivata.b2b.locker.ssoextension

   2. Type: Redirect

   3. URLs: https://oidc.idp.cloud.imprivata.com

2. Assign the SSO Extension to the devices.

Microsoft Intune

1. In Devices > iOS/iPadOS | Configuration > Manage devices > Configuration, create a new policy with the name 'Imprivata Locker SSO Extension'.

   1. Select Templates from the Profile type list.

   2. Select Device features and click Create.

2. Expand the Authentication section of the new policy.

3. For Extension identifier, type com.imprivata.b2b.locker.ssoextension

4. For Type, select Redirect.

5. For URLs, type https://oidc.idp.cloud.imprivata.com

6. Save the SSO Extension and assign it to your devices.

Omnissa Workspace ONE

1. In Resources > Profile Details > SSO Extension, configure the SSO extension for Imprivata Locker.

2. On the SSO Extension tab, configure the following information:

   1. For Extension identifier, type com.imprivata.b2b.locker.ssoextension

   2. For Type, select Redirect.

   3. For URLs, type https://oidc.idp.cloud.imprivata.com

3. Save the SSO Extension and assign it to your devices.

Configure several settings in MAM to support the integration.

1. In the MAM console, go to Admin > Check Out.

2. Switch the Password Autofill and SSO setting to ON.

3. Switch the Require a second factor to unlock the device setting to ON.

   This setting controls whether users must provide a second factor in the Locker app during checkout to unlock the device.

   NOTE:

   This setting is enabled and not visible to disable for organizations created as of MAM 7.0 (June 2025).

Complete Epic build:

• For customers on Epic versions Feb 2026 and earlier, see this Galaxy guide.

• For customers on Epic versions May 2026 and later, see this Galaxy guide.