Google<-SAML->Zscaler Integration Agenda n What is SAML? n - - PowerPoint PPT Presentation

▶
google saml zscaler integration agenda
SMART_READER_LITE
LIVE PREVIEW

Google<-SAML->Zscaler Integration Agenda n What is SAML? n - - PowerPoint PPT Presentation

Feb 17, 2023 263 likes •899 views

Summer Webinar Series Google<-SAML->Zscaler Integration Dianne Dunlap (ddunlap@mcnc.org, 919-248-8439) Client Network Engineering Webinar Links: www.mcnc.org/cne-webinars Google<-SAML->Zscaler Integration Agenda n What is

slide-1
SLIDE 1

Dianne Dunlap (ddunlap@mcnc.org, 919-248-8439) Client Network Engineering

Summer Webinar Series

Google<-SAML->Zscaler Integration

Webinar Links: www.mcnc.org/cne-webinars

slide-2
SLIDE 2

Google<-SAML->Zscaler Integration Agenda

n What is “SAML”? n AAA, Testing, Switching Databases n Lab test setup n Authentication - Google confjguration n Authentication – Zscaler confjguration n Authorization – Google confjguration n Authorization – Zscaler confjguration n Accounting n AD n Caveats n Questions?

slide-3
SLIDE 3

What is “SAML”?

Security Assertion Markup Language XML-based, open-standard data format for exchanging authentication and authorization data between identity provider (IdP) and service provider (SP) IdP=Google SP=Dropbox, Facebook at Work, Docusign, Amazon Web Service, etc. And SP…Zscaler!

slide-4
SLIDE 4

Advantages of Google<-SAML-> Integration

n Consolidation of users in one place instead of Google and Zscaler hosted database n Fewer authentications n One less username and password to remember, synchronized password changes n Ability to add authentication to content-fjltering at no cost n Means to apply fjltering policies by users’ category (authorization) n Removes need for Active Directory or other on-premise directory for fjltering n Advantages of SAML over AD - fewer logins

slide-5
SLIDE 5

Disadvantages of Google<-SAML-> Integration

n Login and a half (username twice, password once) n SAML assertion cookies may be persistent depending on browser, device

slide-6
SLIDE 6

AAA

A=authentication n Who is the user? n Google username/password only A=authorization n What is the user allowed to do? n User’s membership in Google custom Department and/or Groups A=accounting n What did the user do? n Zscaler logs

slide-7
SLIDE 7

SAML – no AD

.

slide-8
SLIDE 8

Considerations – Moving to SAML in Zscaler

slide-9
SLIDE 9

Authentication – Moving to SAML in Zscaler

slide-10
SLIDE 10

Authentication – Moving to SAML in Zscaler

slide-11
SLIDE 11

Authentication – custom category exceptions in Zscaler – GRE/onsite

slide-12
SLIDE 12

Authentication – authentication exceptions in Zscaler – GRE/onsite

slide-13
SLIDE 13

Authentication – SSL decryption exceptions in Zscaler – GRE/onsite

slide-14
SLIDE 14

Authentication – exceptions in Zscaler – pac file

Pac fjle: if(dnsDomainIs(host, "accounts.google.com")) return "DIRECT"; if(dnsDomainIs(host, "gmail.com")) return "DIRECT";

slide-15
SLIDE 15

Lab test setup

k12gapps.mcnc.org, OU=PWM, more OUs below:

slide-16
SLIDE 16

Lab test setup

Google non-custom Attributes ¡ Email ¡ OU/orgUnitPath ¡ Group/Group-email ¡ 9thWonder@k12gapps.mcnc.org ¡ /PWM/Admins ¡ admins@k12gapps.mcnc.org ¡ 2$Fabo@k12gapps.mcnc.org ¡ /PWM/EastEStudents ¡ students@k12gapps.mcnc.org ¡ AlbertEinstein@k12gapps.mcnc.org ¡ /PWM/MainEStudents ¡ students@k12gapps.mcnc.org ¡ 12Gauge@k12gapps.mcnc.org ¡ /PWM/NorthMStudents ¡ students@k12gapps.mcnc.org ¡ AlexanderGrahamBell@k12gapps.mcnc.org ¡ /PWM/SouthMStudents ¡ students@k12gapps.mcnc.org ¡ AndersonPaak@k12gapps.mcnc.org ¡ /PWM/Hstudents ¡ students@k12gapps.mcnc.org ¡ 50Cent@k12gapps.mcnc.org ¡ /PWM/WestEStudents ¡ students@k12gapps.mcnc.org ¡ 2Pistols@k12gapps.mcnc.org ¡ /PWM/EastETeachers ¡ teachers@k12gapps.mcnc.org ¡ ActionBronson@k12gapps.mcnc.org ¡ /PWM/Hteachers ¡ teachers@k12gapps.mcnc.org ¡ 40Glocc@k12gapps.mcnc.org ¡ /PWM/MainETeachers ¡ teachers@k12gapps.mcnc.org ¡ AndreNickatina@k12gapps.mcnc.org ¡ /PWM/NorthMTeachers ¡ teachers@k12gapps.mcnc.org ¡ AlfredHitchcock@k12gapps.mcnc.org ¡ /PWM/SouthMTeachers ¡ teachers@k12gapps.mcnc.org ¡ AliVegas@k12gapps.mcnc.org ¡ /PWM/WestETeachers ¡ teachers@k12gapps.mcnc.org ¡

slide-17
SLIDE 17

Authentication - Configuring Google SAML

slide-18
SLIDE 18

Authentication – Configuring Google SAML

slide-19
SLIDE 19

Authentication – Configuring Google SAML

slide-20
SLIDE 20

Authentication – Configuring Google SAML

slide-21
SLIDE 21

Authentication – Configuring Google SAML

slide-22
SLIDE 22

Authentication – Configuring Google SAML

slide-23
SLIDE 23

Authentication – Configuring Google SAML

slide-24
SLIDE 24

Authentication – Configuring Google SAML

n Enter the Zscaler SSO URL https://login.zscalerone.net:443/sfc_sso n Entity ID: zscalerone.net

slide-25
SLIDE 25

Authentication – Configuring Google SAML

n ‘

slide-26
SLIDE 26

Authentication – Configuring Google SAML

n ‘

slide-27
SLIDE 27

Authentication – Back Up Zscaler

Zscaler backup….

slide-28
SLIDE 28

Authentication – configuring SAML in Zscaler

slide-29
SLIDE 29

Authentication – configuring SAML in Zscaler

slide-30
SLIDE 30

Authentication – configuring SAML in Zscaler

slide-31
SLIDE 31

Authentication – turning on for sublocation in Zscaler

slide-32
SLIDE 32

Authentication – Department with authorization “off”

slide-33
SLIDE 33

Authentication – Department with authorization “off”

slide-34
SLIDE 34

Authorization – Google configuration

slide-35
SLIDE 35

Authorization – adding Department (and/or Group) schema in Google (web)

{ "fjelds": [ { "fjeldName": "Department", "fjeldType": "STRING", "readAccessType": "ADMINS_AND_SELF", "multiValued": true } ], "schemaName": "Department" }

https://support.google.com/a/answer/6327792?hl=en Schema insert page: https://developers.google.com/admin-sdk/directory/v1/reference/schemas/ insert#try-it

slide-36
SLIDE 36

Authorization – populating Department schema in Google (web)

https://developers.google.com/admin-sdk/directory/v1/reference/users/patch#try-it

slide-37
SLIDE 37

Authorization – populating Department schema in Google (web)

slide-38
SLIDE 38

Authorization – adding Department (and/or Group) schema in Google with GAM

n GAM=Google Apps Manager n https://www.youtube.com/watch?v=_dybYXJpBH0

slide-39
SLIDE 39

Authorization – adding Department (and/or Group) schema in Google with GAM

C:\gam> gam info domain C:\gam> gam create schema Department fjeld Department type string multivalued endfjeld C:\gam> gam create schema Groups fjeld Groups type string multivalued endfjeld C:\gam> gam print schemas

slide-40
SLIDE 40

Authorization – populating Department (and/or Group) schema existing users in Google GAM

‘

gam update user janedoe@k12gapps.mcnc.org Department.Department multivalue STUDENT gam update user vct@k12gapps.mcnc.org Department.Department multivalue TEACHER gam update user mrzeke@k12gapps.mcnc.org Department.Department multivalue FRONTOFFICE gam update user vct@k12gapps.mcnc.org Groups.Groups multivalue nonstudent@k12gapps.mcnc.org gam update user janedoe@k12gapps.mcnc.org Groups.Groups multivalue elementary@k12gapps.mcnc.org Groups.Groups multivalue middle@k12gapps.mcnc.org gam update user 50cent@k12gapps.mcnc.org Department.Department multivalue FRONTOFFICE Department.Department multivalue TEACHER

slide-41
SLIDE 41

Authorization – populating Department (and/or Group) schema in Google GAM

gam info user janedoe@k12gapps.mcnc.org

slide-42
SLIDE 42

Authorization – populating new users, OUs, Departments (and/or Group) schema in Google GAM csv

Gam to create new users. File is testuser.csv:

  • gam csv testuser.csv gam create user ~Email password ~Password fjrstname ~fjrstname lastname

~lastname gam csv testuser.csv gam update user ~Email OU ~orgUnitPath gam csv testuser.csv gam update user ~Email Department.Department multivalue ~Zscaler_Dept gam csv testuser.csv gam update user ~Email Groups.Groups multivalue ~Zscaler_Group

slide-43
SLIDE 43

Authorization – updating existing users with Departments (and/or Groups) schema in Google GAM csv

Retrieving list of existing users: gam print users allfjelds gam print users allfjelds > outfjle.csv

slide-44
SLIDE 44

Authorization – updating existing user Departments (and/or Group) schema in Google GAM csv

=IF(ISNUMBER(SEARCH("Admins*",W<row#>)),"NONSTUDENT","STUDENT")

A ¡ W ¡ AG ¡ primaryEmail ¡

  • rgUnitPath ¡

Department ¡ 100kila@k12gapps.mcnc.org ¡ /PWM/MainETeachers ¡ STUDENT ¡ 12gauge@k12gapps.mcnc.org ¡ /PWM/NorthMStudents ¡ STUDENT ¡ 2chainz@k12gapps.mcnc.org ¡ /PWM/EastEStudents ¡ STUDENT ¡ 2pistols@k12gapps.mcnc.org ¡ /PWM/EastETeachers ¡ STUDENT ¡ abrahamlincoln@k12gapps.mcnc.org ¡ /PWM/MainETeachers ¡ STUDENT ¡ abstractrude@k12gapps.mcnc.org ¡ /PWM/Admins ¡ NONSTUDENT ¡ acehood@k12gapps.mcnc.org ¡ /PWM/SouthMStudents ¡ STUDENT ¡ acHonbronson@k12gapps.mcnc.org ¡ /PWM/HTeachers ¡ STUDENT ¡ adamsaleh@k12gapps.mcnc.org ¡ /PWM/WestEStudents ¡ STUDENT ¡ andre3000@k12gapps.mcnc.org ¡ /PWM/Admins ¡ NONSTUDENT ¡ andrenickaHna@k12gapps.mcnc.org ¡ /PWM/NorthMTeachers ¡ STUDENT ¡ andygriffith@k12gapps.mcnc.org ¡ /PWM/NorthMStudents ¡ STUDENT ¡ andymineo@k12gapps.mcnc.org ¡ /PWM/MainETeachers ¡ STUDENT ¡ andyrooney@k12gapps.mcnc.org ¡ /PWM/HTeachers ¡ STUDENT ¡

slide-45
SLIDE 45

Authorization – updating existing users, Departments (and/or Group) schema in Google GAM csv

n gam csv outfjle.csv gam update user ~Email Department.Department multivalue ~Department

slide-46
SLIDE 46

Authorization – updating existing users, Departments (and/or Group) schema in Google GAM csv bat file

@echo off rem Script to pull users from Google using gam and repopulate the Department.Department or Groups.Groups custom fjeld for Zscaler if "%1"=="" echo Google group is undefjned &goto end set infjle=%1 if "%2"=="" echo Zscaler group or department missing &goto end set outfjle=%2 cls echo Do you want for variable to go in schema Groups.Groups or Department.Department for Zscaler? set /p grodep=G/D if %grodep%==G set fjeld=Groups if %grodep%==D set fjeld=Department cls echo.

slide-47
SLIDE 47

Authorization – updating existing users, Departments (and/or Group) schema in Google GAM csv bat file

echo Enter F to continue and associate Google users in group %infjle% with Zscaler %fjeld% %2 and place in %infjle %.csv, %infjle%.%fjeld%.csv echo. echo Enter Y to continue and associate Google users in group %infjle% with Zscaler %fjeld% %2 and place in %infjle %.csv, %infjle%.%fjeld%.csv then modify Google entries using gam echo. echo Enter Q to quit echo. set /p choice=F/Y/Q echo. if %choice%==Q goto end call gam info group %1 > %1.csv echo user,%fjeld%.%fjeld%> %1.%fjeld%.csv FOR /f "tokens=2" %%i in ('type %1.csv ^| fjndstr member:') DO @echo %%i,%2 >> ,%1.%fjeld%.csv if %choice%==Y gam csv %1.%fjeld%.csv gam update user ~user %fjeld%.%fjeld% multivalue ~%fjeld%.%fjeld% :end

slide-48
SLIDE 48

Authorization – department/group attribute mapping in Google

slide-49
SLIDE 49

Authorization – configuring SAML in Zscaler

slide-50
SLIDE 50

Authorization – department/group behavior

* Only the fjrst Department will be used/seen/parsed/ logged by Zscaler

Department Groups Single-membership appearance in logs? Yes No Single-membership fjltering decisions? Yes Yes Multiple-membership appearance in logs? No* No Multiple membership fjltering decisions? No* Yes

slide-51
SLIDE 51

Authorization – department/group behavior

slide-52
SLIDE 52

Authorization – department/group behavior

slide-53
SLIDE 53

Authorization – auto-provisioning

‘

slide-54
SLIDE 54

Accounting - logs

.

slide-55
SLIDE 55

AD – no SAML

.

slide-56
SLIDE 56

SAML with AD

.

slide-57
SLIDE 57

Caveats

‘

Platform Chrome Firefox Google-drive- app MIE Safari Chromebook x N/A N/A N/A N/A ipad x N/A x N/A x Microsoft x x x x N/A Macbook x x x N/A x

slide-58
SLIDE 58

Caveats

https://www.mcnc.org/our-community/k12/docs/web-security/category- defjnitions

slide-59
SLIDE 59

Caveats

slide-60
SLIDE 60

Caveats

slide-61
SLIDE 61

Caveats

slide-62
SLIDE 62

Questions?

n Questions?

slide-63
SLIDE 63

Dianne Dunlap (ddunlap@mcnc.org, 919-248-8439) Client Network Engineering

Summer Webinar Series

Google<-SAML->Zscaler Integration

Webinar Links: www.mcnc.org/cne-webinars