Skip to main content
  • EN

AD_4nXf3hnclqxLS5dS680IARlMzWHhsexi8v1RFpZotSijU2jWlmhcCadWbXC7WAtMNf84-64CWysKdujHmuKFqsgNKR0-VE04i2d0eMVoj2ybLHC6MJk8PXf1v1SATKjwRLcZnU_xmCQ?key=OBGf66YPWI8EwfWfGZe9xTXr

Netskope Global Technical Success (GTS)

Netskope Client Enforcement Using Onelogin

 

Netskope Cloud Version - 122

 

Objective

This document outlines the necessary steps to configure Netskope client enforcement using Onelogin

 

Context

Netskope client enforcement mandates that end users must have the Netskope client installed and actively connected to a Netskope tenant to gain access to SaaS applications through the identity provider (IDP).

With Netskope client enforcement enabled, end users will be able to access the configured SaaS Applications only when Netskope client is enabled on the system. In the absence of Netskope clients, access to SaaS applications will be denied.

This document will also guide through the steps to configure the Netskope Client Enforcement application in Onelogin  as a self-service option to deploy the Netskope Client.

Note: Refer this link to learn more about Netskope client enforcement.

 

This document demonstrates the use of Netskope client enforcement with the pre-configured 'AARP' application within OneLogin. The outlined steps are applicable to any similar SaaS application.

The Application AARP should be accessible to the end user only when the Netskope client is active. If the Netskope client is disabled or uninstalled, access to this Application will be denied.

AD_4nXf4RynDv30pqp6DavRXpWOgFG_bz8aVw290M85a-E-auK0FQhkHgl8Jsm88KZlX9fblVF-QutMyXJDveImGLLG8V899LEw3WRGtPTSNOB4nqyy0jFrR8_38bkDzuaJP0AIo9Hpm?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Lab recreate

Before beginning with the configuration, please ensure that the end user’s email address is already imported into the Tenant under Settings - Security Cloud platform - Users

The following document shows a brief walkthrough of the steps to deploy client enforcement. These are some of the prerequisites:

  • Users are assigned to their respective applications in Onelogin.
  • Access and admin rights into the OneLogin tenant.
  • Access and admin rights in the Netskope tenant.

 

Step 1: OneIogin configurations to create SAML custom connector to allow Netskope client download

Create a SAML connector within One Identity to enforce end users to download Netskope client

Go to Application - Add App

AD_4nXceXxCsok1QHVXbEPhLp72ger1wvG-1iiaB_J9s6NeMhwZVsu3kiVfuK2HqwfZLk5UpA0RsN3tIxju6QY7-W8Pe1mf-aV833hiynWzMWrw48K4Ukr-VtkY7abTLnXHSi0eijUw0?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Look for SAML Custom connector (Advanced)

AD_4nXd_deTNqNwBdLAgNwLxbMBb-YDqLWNjFbsBepRTcCZQ3BtpR9eWLxeb4QzA4zzmp9Y8n5vJP16dvBNiIL0R6O6yjNC2YcYIp0c3N-1lJiApg26GHQBa_xp3JthhmbGx973EJ6XKxA?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Add the application name, import Netskope logo as seen in the screenshot below. Save this Application

AD_4nXcwk5m0nY4wGXLhAA32eB8xSqBAOpZ6paqYxT7e9f2keDAPo8VTnR9kDv953vwewZ5NUhQp5OkVbTYUp8fA3ytiuBscORZjkWfrqUdZrW6FmcPpmao7rdDj05IzmQONlkF0t2NF?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Path: Netskope Tenant UI >>> Settings >>> Security cloud platform >>> Netskope client - Enforcement - Onelogin. 

Copy the values of Redirect URL and Organization ID.

AD_4nXd3pzwDrxxzw4o6KMJ1s5vbi_v9QFj6EsrolLsAqpGVuW0f9hBB_RpP13L95AJ2EIT6t-v6Lk8nUVGd7HfcL7GC4NFLLsOZfLmPOWbPh6jFoqi37gAM1AtTgGwcmHNqA51c51cf?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Go back to the SAML custom connector that you created in OneLogin. Applications - Netskope client enablement. Go to configuration and enter the values captured from Netskope tenant UI as shown below : 

AD_4nXeySR4Rq-AyKd5IwtdsxBhdx_PKeFtzjbMEFv7bIGWMUf3l2LLY3MDdfdyjNQheyyFDMyvLXtDgYgWJIIho6xXJeqWDX4sFMtsS6R5pSg6TfHkmEqlhqXmu0soZ40gA4EIzzW1Ucg?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Adjust the other configurations as seen in the snapshot below

AD_4nXcpxYF1X-9f8b8qai7LhlajNpaLjfLiJJFIYMTHoqNUvOm4pxULF8tcEdPSLuK44kuMC53p9C2RDej3k0IsV3VRElvZSS7f4cPWy06qdmg__pwg69ch_-xISD8dImnlEKgHSulDFw?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Go to SSO Tab and click on “View details” under X.509 certificate. You will be navigated to a new web page that has the certificate. Download the certificate. Once done, save the application.

AD_4nXeVURybX7I2hcl5cuWE9iH2R8_g4q5666xewWMF4e4FO7F8_XdwQyA3HetXNqNIiu9pM-yM3FdhIAs0dUPDgrT3Tp2cXDtYD79j-TJF-HpUaEWxqaNelJH8-o5dhahwB8tOs9Jrmw?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Go back to your Netskope Tenant UI and upload the certificate as seen in the screenshot below. 

Path: Netskope Tenant UI >>> Settings >>> Security cloud platform >>> Netskope client - Enforcement - Onelogin. 

AD_4nXcTzaJqiepF-fY259ITXEUo5hNdFgeB2fSHimMviFmoy99b08mmRIBamomMm7eNe6mfKCv8o4d6ZlRabpQwNStvNn0vl9wRQ6tuya1VWSSxwFNW_Lh-FVE-O9f0yE1oncEfD-jhUg?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Once the Application has been created, assign it to Users / User groups within Onelogin. This application will  allow users to download and install Netskope client when user clicks on the “Netskope client enablement” application created above.

AD_4nXfRfpxjR2aZAC8OSuZW38Z7hoLGRPXVRjPoBMbklxPQpZqwY9o2nlyQ1_jBG7xFCN4f84bZY0dsD2sMc9CY8bn1Xlv-3KECG-ba9XAvyFcpunKdy_Hf5pWFQrRfBYVgdZkt9E5W5A?key=OBGf66YPWI8EwfWfGZe9xTXr

 

AD_4nXe_18136kWcUrSN7VhcHkszZuonJMgZF4N4xpPMsAWOcz7E0JyjiGlhAogxG-GS-R_xg3GxElTudBgq168Pw2w9mHIDWwYgixw4TNpzhWSPQhtTBq-ZORLxsS43SGZnl6o5-fogdA?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Step 2: Configuring IP Allowlisting to allow access to SaaS Applications within Onelogin from Netskope IPs only

This step ensures that the SaaS Applications are restricted to be accessible from selective Netskope IPs only. If a user tries to access the Application in absence of Netskope client,, the access will be denied.

Go to Onelogin and go to Security - Policies and create a new app policy

AD_4nXckk1V_11QkoIR38D_L9amuqEDuh-ic2rzpeVVzp9_rpoitxVt0pz6G50jqA1D7chx2M-Mtpqyj-MjRRcRfFILgvIljB1Ar0H2b_77yVkw5-xwS1q-omdhJKsoY2UwOVrphC2KRnQ?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Add a name to the Policy 

AD_4nXdDZLuSI6HMS5WwYaJyd5tcTqFHgi25MLR-Y_bswEZLs1zFDeBtT_FaqqDFWYMDOdiK679CGlcNMBngosPZ5USx1G9v-W94snQ6s2tqxPsv1tOKPdzNFDYVleOBTIFm3AY4K3i9?key=OBGf66YPWI8EwfWfGZe9xTXr

 

To obtain the Netskope IP addresses for your tenant -

Path: Netskope Tenant UI >>> Settings >>> Security Cloud platform >>> Netskope client - Enforcement and copy the IP addresses from the Netskope IP Ranges section as seen below.

AD_4nXdZAzY-eQ4NoUqzBnF-BrKZKguerXdjmKaTaSZWCflkKZ9EeC_kTPQR7KyJqXdzaAiaIvUf6v6EStr6yPSI0Lphxyrx6nX-a-aESdjlnXlylwLsthJ2aAgfHEJtvreZYRtFgxcV?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Copy these IP addresses and paste them under the Policy created in Onelogin and hit save

AD_4nXe2BJowWWcxIyIILEAk6NedxvA-QPUEnM2OwPm8UoGSuNxS-B9WVLSVnqDSEfJSiFmOS-TbkWkzrLugNV00RsftWbb8hdGO8w9GqW30u4W_Ygdoe3MFwGbdwIOwUZRZCUkvbujPAw?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Step 3: Assign this Security policy to a SaaS App in Onelogin

In one login, go to Applications. For the context of this document, this policy has been assigned to AARP application.

Under the selected application, go to access and choose the Policy created in Step 2. Click Save.

AD_4nXdb146FJq64OU2MsESk3puuNIsk7sdxk12OXEYYRGG85uUs-rPhPrimkV7w9Wr-NMjmXgkuH14-Iuu21RmTjiiCWTaaq8pviXsR97aWQkb3FuIlnfGGqjN5hALLlSgmdj8JGjrwMQ?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Verification

Log in to onelogin using the ID which has the Netskope client enablement application assigned. 

AD_4nXcWYa_ooDmDPoR7M3PBWyxuEFHeefW4ValNDW6iMwnxS8GvO71JHmtkDWYnIOr3kRHJKXtHgwcxm42fZIrCah6rf3cy3ABjmMhUqz5vec-zzwmggrAank-Z-13v7ppykAwNOJmOGg?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Try accessing the AARP application in the absence of Netskope client and you will receive the below “access denied” notification

AD_4nXdo4L8qw5AiIFjpoBybpUWaXGb99WucRbpvSn4u_ghQ1Qr_4p0XFGOxVpA5B0juHBF1Y64n8Bj66cEkLJSFqCdHfN7y4tYklPfBGZBCXrKbfXhvq-46O0S9eKCz87CprVgTNLAoFg?key=OBGf66YPWI8EwfWfGZe9xTXr

 

If you click on the Netskope client enablement application, you will be redirected to download the Netskope client. This will ensure that users are enforced to access the SaaS applications with Netskope client enabled. 

AD_4nXeL4mS826-QA3NcrCHo7MqHfFShv8MEml9QU9wyU0UiKNwyKVHz0fJ3CQZ928lN24JfrX5vlFJ-sHqI4bOX8d52DrxPCp6U_mHhrmQLECold4-7I9uknyEiBEPqXEoMU68k8IEzMQ?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Please note that the above template has been modified from the Netskope Tenant Web UI.

Path: Netskope Tenant UI >>> Settings >>> Tools >>> Templates

AD_4nXfOuRgxeZuNwnY-KOdUB9_T2EC21Cf9UbGyw6z9kU7sbu1zzhUsOzFkxzRCmu7kJZ9Z-4YtT2VHaZHXqmTUGVgfKRTAj9t-FfTpbm0J36ObIaVU-3ao7yod3H2BEE1Ym2mb_WElXA?key=OBGf66YPWI8EwfWfGZe9xTXr

 

The default template will look like below

AD_4nXeHnIGkZx4jjR9xIb9UBs1zfuLI553Qyutmumt7Jibdmkk7v-nwQzpQeDmXJfQYXgKuXUUZmZ9qjmAuVTdES2A82Ab8xYw1jIh4JBM5DXwBrZsIOJfoExjKTWOjXOd_jE5ErBnhWQ?key=OBGf66YPWI8EwfWfGZe9xTXr

 

Terms and Conditions

  • All documented information undergoes testing and verification to ensure accuracy.
  • In the future, If any such platform changes are brought to our attention, we will promptly update the documentation to reflect them.

 

Notes

  • This article is authored by Netskope Global Technical Success (GTS).
  • For any further inquiries related to this article, please contact Netskope GTS by submitting a support case with 'Case Type – How To Questions'.
Terms & ConditionsCookie settings