{"id":76,"date":"2024-05-13T14:55:34","date_gmt":"2024-05-13T14:55:34","guid":{"rendered":"http:\/\/gigabrit.com\/?p=76"},"modified":"2024-05-13T14:55:34","modified_gmt":"2024-05-13T14:55:34","slug":"building-a-zscaler-lab-part-3-scim-enablement","status":"publish","type":"post","link":"https:\/\/gigabrit.com\/?p=76","title":{"rendered":"Building a Zscaler Lab Part 3 (SCIM enablement)"},"content":{"rendered":"\n

Welcome back, so far we’ve stood up our Azure and Zscaler tenants and connected them with SAML Authentication. Next we need to enable the SCIM (System for Cross-domain Identity Management). If you’re an old Systems and Data Center person like me, don’t feel bad if you had to look up what SCIM is. I had to look it up too. <\/p>\n\n\n\n

A quick check of the Book of Knowledge (aka Wikipedia)<\/a> tells us…”SCIM  is a standard for automating the exchange of user identity information between identity domains, or IT systems.” <\/p>\n\n\n\n

Easy enough, essentially it’s a trusted method for managing CRUD<\/a>. With the added benefit of also being about to tell the system it’s updating specific attributes about the user or group that it’s changing. <\/p>\n\n\n\n

Let’s get started , Zscaler official documentation for this process is here<\/a>.<\/p>\n\n\n\n

Login to your Zscaler Admin portal , I’m doing this in the ZIA admin portal. Then we’ll navigate to the Administration > Authentication Settings<\/strong> section. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now let’s go to Identity Providers<\/strong> tab, Edit<\/strong> the IdP we setup before.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Scroll to the Provisioning Options<\/strong> section.<\/p>\n\n\n\n

Click Enable SCIM Provisioning.
Copy the Base URL<\/strong> URL and the Bearer Token<\/strong> to your secure notes.
Click Save<\/strong> when complete.
Activate<\/strong> your changes.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now let’s add in the Exempted URL’s. Browse to Administration \u2192 Cloud Configuration \u2192 Advanced Settings<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Scroll to AUTHENTICATION EXEMPTIONS<\/strong> and add the following URLs.<\/p>\n\n\n\n

login.windows.net<\/code><\/p>\n\n\n\n

login.microsoftonline.com<\/code><\/p>\n\n\n\n

*.windowsazure.com<\/code><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click SAVE<\/strong>, and of course, Activate<\/strong> your changes!<\/p>\n\n\n\n

Next we’re going to login to Azure and connect everything together. On your Azure Portal, browse to your Entra ID service > Manage > Enterprise Applications<\/strong> , then Select your Zscaler ZIA Tenant Cloud we setup earlier. In my case it’s Zscaler Two. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

From there, expand under Manage<\/strong> and select Provisioning<\/strong>. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select the Get Started<\/strong> button to launch the Provisioning wizard. First change the Provisioning Mode<\/strong> to Automatic<\/strong>. <\/p>\n\n\n\n

Under Admin Credentials<\/strong> enter the following:<\/p>\n\n\n\n

Tenant URL<\/strong>: Paste in the Base URL<\/strong> from your Secure Notes<\/p>\n\n\n\n

Secret Token<\/strong>: Paste in the Bearer Token<\/strong> from your Secure Notes <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click Test Connection<\/p>\n\n\n\n

You should get a message indicating a success. If you get an error, double check your Tenant URL and Bearer Token are correct. If needed re-generate a new Bearer Token in the ZIA Admin Console. <\/p>\n\n\n\n

After getting a Confirmation of a Successful Test, Click Save. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now Exit the Provisioning by clicking the X in the right corner. Then we need to re-enter Provisioning by Edit Provisioning. This is because the Settings section won’t update without exiting first. <\/p>\n\n\n\n

Once back in the Provisioning<\/strong> page, Expand the Settings<\/strong> section and set the Scope to Sync Only assigned users and groups<\/strong> make sure the Provisioning Status<\/strong> is On<\/strong>, then click Save<\/strong> at the Top. Exit the Provisioning pane. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Assigning users and groups<\/strong><\/p>\n\n\n\n

Now in the Enterprise Application in Azure for your Tenant, Select Users and Groups. We will add the appropriate Users\/Groups that we want to use Entra ID for IdP into Zscaler. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select Add user\/group and assign your resources. Be sure to save of course. <\/p>\n\n\n\n

At this point you should be able to Test Logging into Zscaler Client Connector with your Entra ID Credentials. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When you sign if you are brought to your iDP sign in page, Success!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Next series of Posts we’ll start digging into some additional lab content and how the services for Secure Internet and Remote Application Access work. <\/p>\n","protected":false},"excerpt":{"rendered":"

Welcome back, so far we’ve stood up our Azure and Zscaler tenants and connected them with SAML Authentication. Next we need to enable the SCIM (System for Cross-domain Identity Management). If you’re an old Systems and Data Center person like me, don’t feel bad if you had to look up what SCIM is. I had … Continue reading Building a Zscaler Lab Part 3 (SCIM enablement)<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-76","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/gigabrit.com\/index.php?rest_route=\/wp\/v2\/posts\/76","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gigabrit.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gigabrit.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gigabrit.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gigabrit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=76"}],"version-history":[{"count":3,"href":"https:\/\/gigabrit.com\/index.php?rest_route=\/wp\/v2\/posts\/76\/revisions"}],"predecessor-version":[{"id":98,"href":"https:\/\/gigabrit.com\/index.php?rest_route=\/wp\/v2\/posts\/76\/revisions\/98"}],"wp:attachment":[{"href":"https:\/\/gigabrit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=76"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gigabrit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=76"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gigabrit.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=76"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}