Skip to main content

Zscaler Integration Guide

  • Updated

 

This guide provides information on how to:

  • Set up Beyond Identity as a passwordless authentication solution for your Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) services.
  • Set up Beyond Identity to enforce corporate Zero Trust policies by using Zscaler Mobile Portal APIs.

Important

  • For passwordless authentication, you may integrate Zscaler with Beyond Identity, either directly or via their existing SSO. This document describes the direct integration between Zscaler and Beyond Identity. For integration via SSO, please contact Beyond Identity.
  • Zscaler’s direct integration with Beyond Identity is applicable to Zscaler Client Connector for ZIA and ZPA, and ZPA Admin Console. It’s not applicable to ZIA Admin Console because ZIA Admin Console does not support SP-initiated SAML flow and Beyond Identity does not support IdP-initiated SAML flow.
  • Both ZIA and ZPA Provisioning is supported with SCIM-supported directory or SSO while supporting Authentication directly with Beyond Identity as the IdP.

Contents

How this integration works

 

architecture.png

 

Prerequisites

License Requirements

This integration provides support for Zscaler under the following plan versions:

  • Zscaler Business
  • Zscaler Transformation
  • Zscaler Unlimited

Authentication Requirements

The Zscaler integration uses the OAuth 2.0 Client Credentials Grant Type, and therefore uses a Client ID and Client Secret for authentication.

Role/Access Requirements

  • Zscaler Role/Access
    • A Zscaler account with “Super” admin privileges to configure SAML IdP.
    • Zscaler Mobile APIs enabled for your tenant (mobileadmin.<Zscaler cloud>.net). Look for the Administration tab and “Public API” on the left side menu.
  • Beyond Identity Role/Access
    • Log in as a user with a minimum role of ‘Integrations Administrators’ for adding and configuring integrations and ‘Policy Administrators’ for configuring policy

OS support on Beyond Identity

  • Zscaler supports Windows, macOS, iOS, and Android.

ZPA Admin Authentication Configuration

To configure Beyond Identity as the IdP for ZPA Admin Login, follow the steps below. Once these steps are complete, you will be ready to enable Beyond Identity for Admin Login to ZPA Console.

  1. Sign in to the ZPA Admin Console as an Administrator.
  2. Navigate to Administration > IdP Configuration.
    ZPA admin advanced.png
  3. On the IdP configuration tab, select the Add IdP Configuration blue plus sign. 
  4. In the IdP Information tab provide the following and click Next.
    • Name: Type "Beyond Identity Admin SSO".
    • Single Sign-on: Select “Admin”.
    • Admin SP Certificate Rotation: Select the correct certificate.
    • Domains: Select the appropriate domain from the drop-down menu.
  5. On the SP Metadata tab, download the Service Provider Metadata to use in the following steps and click Next.
    Add IDP Config.png
  6. Configure Beyond Identity as the IdP.
    1. Log into the Beyond Identity Admin console.
    2. Navigate to Integrations > SAML tab.
    3. Click Add SAML Connection and update the fields as follows:
      1. Click Upload XML and select the “SP Metadata” xml file downloaded in the previous step.
      2. Enter “Zscaler Private Access Admin SSO” for the Name. 
      3. Click Save Changes.
        saml integration.png
      4. When you return to the SAML Connections list, copy the following fields from the recently created SAML Connection. These will be used in the next step. 
  1. In the Zscaler Private Access Admin Console, on the IdP Configuration tab, configure the following and click Save.

ZPA USER Authentication Configuration

To configure Beyond Identity as the IdP for ZPA User Login, follow the steps below. Once these steps are complete, you will be ready to enable Beyond Identity for User Login to ZPA Client Connector.

  1. Sign into the ZPA Admin Console as an Administrator.
  2. Navigate to Administration > IdP Configuration.
    ZPA User auth config.png
  3. On the IdP configuration tab select the Add IdP Configuration blue plus sign. 
  4. In the IdP Information tab, provide the following Information and click Next.
    • Name: Beyond Identity User SSO
    • Single Sign-on: Select “User”.
    • User SP Certificate Rotation: Select the correct certificate.
    • Domains: Select the appropriate domain from the drop-down menu.
  5. On the SP Metadata tab, download the Service Provider Metadata to use in the following steps and click Next.
    Add SP Metadata.png
  6. Configure Beyond Identity as the IdP for ZPA User Login:
    1. Log into the Beyond Identity Admin console.
    2. Navigate to Integrations > SAML tab.
    3. Click Add SAML Connection and update the fields as follows:
      1. Upload the “SP Metadata” xml file downloaded in the previous step.
      2. Enter “Zscaler Private Access User SSO” as the Name. 
      3. Click Save Changes.
        user zpa.png
      4. Note the following fields from the SAML Connection. These will be required in the next step.
  1. In the Zscaler Private Access Admin Console, on the IdP Configuration tab, configure the following.

ZIA USER Authentication Configuration

To configure Beyond Identity as the IdP for ZIA User Login, follow the steps below. Once these steps are complete, you will be ready to enable Beyond Identity for User Login to ZIA Client Connector.

  1. Sign in to the ZIA Admin Console as an Administrator.
  2. Navigate to Administration > Authentication Settings.
    ZPA User auth config.png
  3. Select the Identity Providers tab.
    Auth Settings.png
  4. Click Add IdP.
    • Download the SP Metadata file and save it to use in the next step.
  1. Configure Beyond Identity as the IdP for ZIA User Login.
    1. Log into the Beyond Identity Admin console.
    2. Navigate to Integrations > SAML tab.
    3. Click Add SAML Connection and update the fields as follows:
      • Upload “SP Metadata” xml file downloaded in the previous step.
      • Type “Zscaler Internet Access User SSO” for the Name.
      • Click Save Changes.
        Import SP Metadata 2.png
  1. Copy the following from the recently created SAML Connection. This will be required in the next step.
  1. In the Zscaler Internet Access Admin Console, on the IdP Configuration tab, configure the following and click Save.
    • IdP SAML Certificate: Upload (Downloaded in previous step)
    • SAML Portal URL: https://auth.byndid.com/saml/v0/<BI-Connection-ID>/sso (Copied in the previous step).
    • Status: Enabled
    • Login Name Attribute: NameID
    • Vendor: Others
    • Sign SAML Request: Disable
    • HTTP-Redirect: Enabled
    • Enable SAML Auto Provisioning: Disable
    • Enable SCIM Provisioning: Disable
      Edit IDP 2.png
  1. To Enable the SAML configuration on the Authentication Settings page: 
    1. Select the Authentication Profile tab.
    2. Select SAML as the Authentication type.
    3. Save and activate the configuration.
      Auth Settings.png

 

Mobile Portal Configuration to Enable API Access

This section describes changes required to the Zscaler Mobile Portal to enable API access.

  1. Log into the Zscaler Client Connector (Mobile) portal from ZIA (Policy > ZCC Portal). 
    You can also access it in the ZPA Admin Console by selecting Client Connector from navigation bar.
  2. In the ZCC portal, click Administration and then click the Public API.
    Zscalar API.png
  3. Click Add API Key, configure the following and click Save.
    • Name: Beyond Identity
    • Status: Enabled
    • Role: Write
    • Session Validity Interval in seconds: 31540000 (Approx. 1 year)
      Add API Key.png
    1. Note the following to use in the next section.
      • Client Secret
      • Client ID 
    •  

Beyond Identity Console Configuration for Zscaler API Access

Beyond Identity supports continuous authentication and monitors device security posture even when the user is not actively trying to authenticate. Beyond Identity uses Zscaler Mobile APIs to force re-authentication of the Zscaler Client Connector in case the device security posture does not meet enterprise policies.

In this section, you’ll create a test group with a single user to test the Deny rule before configuring the policy to target all users.

Note: Before you start, you'll need the Client ID, Client Secret, and Zscaler Mobile Portal URL, which you should have copied from the previous section.

  1. You will need Client ID, Client Secret and Zscaler Mobile Portal URL before proceeding with the next steps of configuring Beyond Identity Integration with Zscaler Cloud.
  2. Log into the Beyond Identity Admin console and navigate to Integrations > Endpoint Management > Zscaler > Edit Configuration.
    Edit zscaler.png
  3. Enter the Zscaler Mobile Portal URL (Host Url), Client ID, and Client Secret you copied from the previous section.
  4. Select whether to match on the username or email for the User Key.
  5. Click Save Changes.

Test the Integration

To test the integration, you'll create a test group, user, and a policy in Beyond Identity and use Zscaler to confirm the authentication is denied. 

  1. Log into the Beyond Identity Admin console.
  2. Navigate to Groups > Add Group and create a test group. 
  3. Assign a single test user to the test group. 
  4. Navigate to Policy > Edit Policy > Add Rule.
    1. Create a Deny rule to deny authentication and invoke Zscaler Force Remove Device API. 
    2. Add a custom notification saying Zscaler Client Connector will be logged out soon!!!
    3. Click Add and create a new rule in the policy to force remove an authenticated device.
      Policy Rule.png
    4. Change the rule order as needed and click Publish changes. 
  5. Log into Zscaler Client Connector using the test user.
    1. Authenticate to any application using Beyond Identity ensuring the authentication meets the criteria to trigger the Deny rule.
      The custom notification should appear and the Zscaler Client Connector should log out within a 3-minute timeframe. 
  6. If the test was successful, configure the policy to target all users.

Frequently Asked Questions

How are devices matched to the Zscaler device directory?

This integration leverages the Zscaler Client UUID. The Client UUID is a unique string assigned to all devices in Zscaler. In circumstances that the Client UUID cannot be found, Beyond Identity may use the serial number to match devices to records.

How does the Zscaler Client Disconnect action work for mobild devices?

If the Zscaler Client Disconnect action is triggered against a mobile device, Beyond Identity will issue disconnection action API calls for all mobile devices. This is due to restrictions in mobile operating sustems that prevent Beyond Identity from uniquely identifying the mobile device.

What rate limits apply to this integration?

All requests to the Zscaler API are subject to a rate limit. For an organization, the system rate limits all endpoints called from a given IP address to 100 API calls per hour.



Related articles

Comments

0 comments

Please sign in to leave a comment.