Authentication

Authentication

1. User vs. Location Authentication

   • Location authentication One policy controls all users It can be applied if user authentication is not being used
   • User Authentication
   • Authentication concepts
   • Surrogate IP Policies are tied to an IP address instead of  a user. XFF means X-Forwarded-For The X-Forwarded-For (XFF) HTTP header field is a common method for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer. The general format of the field is: X-Forwarded-For: client, proxy1, proxy2[3] where the value is a comma+space separated list of IP addresses, the left-most being the original client, and each successive proxy that passed the request adding the IP address where it received the request from. source: https://en.wikipedia.org/wiki/X-Forwarded-For
   • XFF
     • Surrogate IP XFF means X-Forwarded-For The X-Forwarded-For (XFF) HTTP header field is a common method for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer. The general format of the field is: X-Forwarded-For: client, proxy1, proxy2[3] where the value is a comma+space separated list of IP addresses, the left-most being the original client, and each successive proxy that passed the request adding the IP address where it received the request from. source: https://en.wikipedia.org/wiki/X-Forwarded-For

2. User Provisioning

   • Two part process Provisioning + Authentication

3. Supported Authentication Methods

   • User authentication trumps local authentication
   • First question is request comming from a non-location? Blue arrows
   • If authentication is enabled and local user authentication is enabled then both policies will be applied
   • Red arrows Can user authenticate? if yes then apply policy if no then refuse authentication
   • Hosted DB
     • Mannual process Users added via the Admin UI Don't scale easily
     • Authentication Flow All steps happen over SSL no data is sent in the query or at any point in the authentication phase
     • Should only be used for POC or very small numbers of users
   • SAML
     • Three pieces on SAML: Service provider Identity provider Client (web browser on user's PC)
     • SSO (Single Sign-On) User authenticates in one server then without any extra authentication he's capable to autneticate on another server
     • Authentication flow SAML Assertion Identity is basically a token that's presented to Zscaler
   • LDAP
     • When synchronizing your LDAP to Zscaler passwords will not be copied
     • What are forests on LDAP? P.S: Forests remind me of private Vlans LDAP functional integration gets looser as you go from domain -> forest -> multiple forest levels of trust. Within a domain everything by default is trusted (but possibly not authorized), within a forest transitive trusts allow all member domains to have visibility and to trust objects in other member domains while keeping things like replication traffic and administrative boundaries under control. Domains that have a close organisational relationship but that need to be kept distinct for any reason belong to a forest in order to simplify large scale administration\organisation. So you might have production.acme.com, test.acme.com, Tokyo.acme.com etc. as separate domains in a single forest. You will have a consistent name space, and schema and (in general) easy mechanisms for accessing or providing access to objects across domains because, by default, you have transitive trusts between all domains within a Forest. If your organisational structure requires that certain domains have a different schema, or you require that multiple IT groups need direct ownership of their directory services, or you have a need to have more complete administrative separation between some domains then you need a multi-forest design with some trusts between the forests (or possibly just between specified domains). The above is based on Active Directory but the same principles should apply to any LDAP environment.
     • Authentication Flow Zscaler CA searches for the user on the Zscaler DB by login/attributes or e-mail address specified by the user if the CA finds the user it requests the password, if the password is accepted it tries to bind to the LDAP
     • (ZAB) Zscaler Authentication Bridge  Zscaler not allowed to connected your LDAP. VM to communicate to your Directory server
     • LDAP Troubleshooting
   • Kerberos
     • Highlights: No auto provisioning
   • User Password Recovery options
     • To offload password management from the admin and allow users to manage access 
     • One-Time Token
       • Needs to be enabled
     • One-Time Link

Images and files in the map