Zendesk SSO with Cloud Secure using MobileIron MDM Server and Okta

Zendesk SSO with Cloud Secure using MobileIron MDM Server and Okta Configuration Guide Product Release Document Revisions Published Date 1.0 1.0 May 2016

Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose CA 95134 http://www.pulsesecure.net. 2016 by Pulse Secure, LLC. All rights reserved. Pulse Secure and the Pulse Secure logo are trademarks of Pulse Secure, LLC in the United States. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Pulse Secure, LLC assumes no responsibility for any inaccuracies in this document. Pulse Secure, LLC reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Zendesk SSO with Cloud Secure using MobileIron MDM Server And Okta Configuration Guide. The information in this document is current as of the date on the title page. END USER LICENSE AGREEMENT The Pulse Secure product that is the subject of this technical documentation consists of (or is intended for use with) Pulse Secure software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at http://www.pulsesecure.net/support/eula. By downloading, installing or using such software, you agree to the terms and conditions of that EULA. Revision History The following table lists the revision history for this document. Revision Date Description 1.0 May 12, 2016 Initial publication 2016 Pulse Secure, LLC. 2

Zendesk SSO with Cloud Secure using MobileIron MDM Server and O TABLE OF CONTENT CHAPTER 1 OVERVIEW... 5 PRE-REQUISITES:... 5 CHAPTER 2 OKTA IDP CONFIGURATION... 6 STEPS TO CONFIGURE... 6 CHAPTER 3 ZENDESK CONFIGURATION... 12 STEPS TO CONFIGURE... 12 CHAPTER 4 CLOUD SECURE CONFIGURATION... 14 STEPS TO CONFIGURE... 14 CHAPTER 5 MOBILEIRON MDM CONFIGURATION... 20 STEPS TO CONFIGURE... 20 CHAPTER 6 CONFIGURING IN IOS DEVICE... 22 2016 Pulse Secure, LLC. 3

LIST OF FIGURES Figure 1 Architectural Diagram... 5 Figure 2 Add Edit Endpoint... 6 Figure 3 Metadata File... 7 Figure 4 General Settings... 8 Figure 5 Sign-On Options... 9 Figure 6 Provisioning... 10 Figure 7 Assign to People... 11 Figure 8 Zendesk Login Page... 12 Figure 9 Security Page... 13 Figure 10 Virtual Port... 14 Figure 11 SAML Settings... 14 Figure 12 SAML IdP Settings... 16 Figure 13 Add Service Provider... 17 Figure 14 MobileIron as MDM server... 18 Figure 15 Allowed Server... 19 Figure 16 To Create SAM Policies... 19 Figure 17 Add VPN Setting... 20 Figure 18 Application VPN Setting... 21 Figure 19 Apply Labels... 21 Figure 20 Welcome Mail... 22 2016 Pulse Secure, LLC. 4

Chapter 1 Overview Cloud secure provides Solution for Secure Sign On for Cloud services if they are already using Third-party MDM solution that allows the administrator to manage cloud app to define or deploy Per-App VPN settings using Okta as Identity management provider. SAML federation with third party identity providers (OKTA) act as inbound SAML identity provider. This Document provide end to end configuration for Zen desk cloud service SSO using Cloud Secure as an Identity Provider along with MobileIron MDM server and Okta as identity Management provider. Pre-requisites: Pulse Connect Secure minimum version 8.2r3 MobileIron Core 8.5.0.0 build 123 IPhone ios latest version 9.X Figure 1 Architectural Diagram 2016 Pulse Secure, LLC. 5

Chapter 2 OKTA IdP Configuration Steps to Configure 1. Login as Admin and click Admin to configure Pulse Connect Secure as IdP. 2. Navigate to Security-> Authentication-> Inbound SAML to add Pulse Connect Secure configure details as below: Figure 2 Add Edit Endpoint 3. Download Metadata from SAML Metadata file to configure OKTA as service provider in Pulse Connect Secure shown below : 2016 Pulse Secure, LLC. 6

Figure 3 Metadata File 4. To add Zendesk application in OKTA for SSO a. Navigate to Applications-> Application page b. Type Zendesk in search list and click Add for adding the application. c. Under (Required) General Settings, provide Zendesk domain details and click Next. 2016 Pulse Secure, LLC. 7

Figure 4 General Settings d. Under (Required) Sign-On Option, select SAML2.0 and Application Username Format as Email. 2016 Pulse Secure, LLC. 8

Figure 5 Sign-On Options e. Procedure to configure Zendesk Service Provider with SSO configuration click View Setup Instruction f. Configure the (Optional) Provisioning Setting as below figure : 2016 Pulse Secure, LLC. 9

Figure 6 Provisioning g. Under (Optional) Assign to People, assign Zendesk to people and click Next. h. Click Done to save the configurations. 2016 Pulse Secure, LLC. 10

Figure 7 Assign to People 2016 Pulse Secure, LLC. 11

Chapter 3 Zendesk Configuration Steps to Configure Create a user account in Zendesk using the following link https://www.zendesk.com/register#getstarted Complete the registration and login to the Zendesk account. Figure 8 Zendesk Login Page 5. From the console, go to Security. 6. Enable Single Sign-On. 7. Set the SSO parameters as follows: a. Enable the SAML. b. Enter the SAML SSO URL (for example : https://dev- 835358.oktapreview.com/app/zendesk/exk6115mwclmh3RyV0h7/sso/saml c. Enter the Certificate Fingerpring as 4bb672273e8921b207d6d28cdc5ad636f197b0ce 2016 Pulse Secure, LLC. 12

Figure 9 Security Page d. Enable SSO for both Admin and Users (On Admins and End-Users tab). 2016 Pulse Secure, LLC. 13

Chapter 4 Cloud Secure Configuration Steps to Configure The steps to configure Pulse Connect Secure as Identity Provider: 1. Login to Pulse Connect Secure admin console. 2. Choose Network-> Internal Port-> Virtual Port to create a new port with a new IP to redirect URL given for SSO in Zendesk. Figure 10 Virtual Port 3. Select System-> Network-> Host and add Host Entry (for example : ppsqa-sso.pulsesecuredev.net) 4. Navigate to System-> Configuration-> SAML->Settings a. Enter Host FQDN for SAML (for example : ppsqa.pulsesecuredev.net) b. Enter Alternate Host FQDN for SAML (for example : ppsqa-sso.pulsesecuredev.net ) Figure 11 SAML Settings 2016 Pulse Secure, LLC. 14

Note: Alternate Host FQDN for SAML is DNS Host name for virtual port IP which is configured in above step 2. 5. Navigate to System-> Configuration-> SAML and click New Metadata Provider. a. Enter the Name and OKTA Metadata xml file downloaded from OKTA website. b. Select Role as Service Provider and Save. 6. Go to Authentication->Signing In->Sign-in SAML->Identity Provider. a. Enable both Post and Artifact b. Select the appropriate Signing Certificate. c. Enable Reuse Existing NC and Accept Unsigned AuthnRequest. d. Under User Identity, select Subject Name format as Email Address and Subject Name as <USERNAME>@pulsesecure.net 2016 Pulse Secure, LLC. 15

Figure 12 SAML IdP Settings 7. Click on Add SP on the configuration page: a. Select Configuration mode as Metadata. b. Enter the Entity ID (the Entity ID will be the Zendesk domain). c. Enter the Assertation URL (for example : https://ppsngsa.zendesk.com/access/saml) d. Enable Post Protocol Binding and Reuse Existing NC. e. Click on Save Changes. 2016 Pulse Secure, LLC. 16

Figure 13 Add Service Provider 8. To configure MobileIron as MDM Authentication Server a. Navigate to Authentication-> Auth servers and select MDM server-> New Server. b. Enter the required fields and click Save Changes. 2016 Pulse Secure, LLC. 17

Figure 14 MobileIron as MDM server 9. Select Authentication Server with Certificate Auth for Realm and select Device Attributes server as MobileIron. 10. Navigate to User Realm-> Role Mapping rule to configure device attribute rule as below: a. Enter the Name to identify the MDM Server. b. Then assign the available roles to selected roles. c. To manage the roles, see the Roles Configuration page. d. Click on Save Changes / Save + New. 11. Go to User Roles-> Users-> General-> Overview a. Enter the Name and (Optional) Description. b. Enable Pulse Secure Client and Secure Application Manager c. Click on Save Changes. 12. Go to Users-> User Roles-> Users-> SAM-Applications. 13. Click on Add Server and enter the following details: a. Enter the Name to identify the server. b. Enter the Allowed Server (and Ports), mention the virtual port IP and port created in Step2. 2016 Pulse Secure, LLC. 18

Figure 15 Allowed Server 14. Go to Users -> Resource Policies -> SAM -> Access Control and create ACL for the resource similar to the following example Figure 16 To Create SAM Policies 2016 Pulse Secure, LLC. 19

Chapter 5 MobileIron MDM Configuration This solution assumes that the administrator has a basic understanding on MobileIron and the additional more details refer to MobileIron Documentation. This deployment is for MobileIron version VSP 5.9.2 Build 11. Steps to Configure To define a MobileIron MDM Configuration for Zendesk SSO follow the below steps: 1. Login to the MobileIron server. 2. Goto Policies & Configs -> Add New-> VPN. 3. Enter the Name and Description. 4. Select Connection Type as Pulse secure SSL 5. Enter the Server URL as PPS fqdn 6. Select Identification Certificate 7. Enable per app VPN. 8. Under the Safari Domain, configure FQDN of SAML SSO URL Figure 17 Add VPN Setting 9. Go to Apps, to change the Selected Platform to ios. 10. Select Edit option to modify or to change any settings to application 11. Select the VPN profile created from the Per-App VPN setting and click Save 2016 Pulse Secure, LLC. 20

Figure 18 Application VPN Setting Follow the same procedure to add applications that needs to send data through the VPN. 12. Select App-> Zendesk App->Actions->Apply to Labels. 13. Select the label and click Apply to apply Zendesk Application. Figure 19 Apply Labels 2016 Pulse Secure, LLC. 21

Chapter 6 Configuring in ios Device The steps to follow configuring in ios device: 1. Install Pulse Client on the ios device. 2. An email from MobileIron will be sent to User email id, follow the device registration details to enroll and install the profiles on device. Figure 20 Welcome Mail 3. Launch of Zendesk app will initiate per app VPN connection. 4. Pulse Connect Secure will use MDM to fetch device attributes to do role mapping and provide the role. 5. Tunnel will be established based on role mapping validation. 6. Enter Custom domain on application (for example : psecure.zendesk.com) 7. Click Continue. 8. Cloud Server will request to OKTA Identity server and redirect request to Pulse Connect Secure Identity Provider to reuse existing user to construct SAML response and return to OKTA. 9. The application is installed with Secure Sign-On and application will load the Zendesk resource page.. 2016 Pulse Secure, LLC. 22