Cookbook for Ivanti Connect Secure

10 min

Ivanti Connect Secure can work as SAML service provider. Use Okta or any appropriate IDP and configure a Customer SP federation pair on Ivanti Access using Ivanti Connect Secure SP and IDP.

This cookbook considers Okta as the identity provider.

If the user tries to configure Request Header rule with Header Name as “Referer”, the configured header rule will not be evaluated by Ivanti Access. This occurs as by default, Ivanti Connect Secure does not send Referer Header in the SAML request.

Complete the following procedure to configure Ivanti Connect Secure.

Before you begin

Ensure your global SAML configuration is correct

Under System > Configuration > SAML, select Settings. Validate or populate Host FQDN for SAML with the FQDN of your Ivanti Connect Secure Appliance

Click Save.

Creating metadata file for Ivanti Connect Secure

Under System > Configuration > SAML, select New Metadata Provider.

Enter a Name such as Access_ZSO.

Select Remote for location.

Enter the Download URL provided by Okta.

Verify the Identity Provider for roles.

Click Save. It takes a few moments for the values to populate from the Metadata Service. Refresh the page to see if download was successful or not.

Downloading metadata on Ivanti Connect Secure

Under Authentication > Auth. Servers choose new SAML Server and click New Server.

Enter a Name such as Access_ZSO.

Select 2.0 for SAML Version.

Select Metadata for Configuration Mode.

Select the Identity Provider Entity Id from your Okta SAML Metadata Provider (In Creating metadata file for Ivanti Connect Secure).

Select POST for SSO Method.

Select the Okta SSO Certificate.

Select a valid Device Certificate for Signing.

Click Save.

Edit the Authentication Server created and click Download Metadata.

Configuring Federated Pair on Ivanti Access

Click Profile> Federation > Add Pair.

Select Pulse Secure as the service provider.

Upload Pulse SAML metadata.xml saved in Downloading metadata on Ivanti Connect Secure.

Select Use Ivanti Tunnel Certificates for SSO .

Click Next.

Select Okta as the identity provider in the catalog.

Upload the Okta Metadata.

Click Done.

Publish the profile.

Updating Ivanti Connect Secure configuration to federate with Ivanti Access

Edit the metadata provider created in Creating metadata file for Ivanti Connect Secure.

Enter the Access IDP Metadata (Upload to SP) download URL.

Click Save. Refresh the page to ensure that the new metadata is downloaded successfully.

Edit the SAML Auth server created in Downloading metadata on Ivanti Connect Secure.

Edit and update the Identity Provider Entity ID to newly updated access url.

Select the Access SSO Certificate.

Click Save.

Updating Okta configuration to federate with Ivanti Access

Additional configurations on Pulse Secure required for end-end flow

The following configuration is for users with ZSO enabled on Ivanti Access admin portal.

Enable ZSO for user portal

Configure Users Realm to use SAML Auth Server

Enter a name for realm and select SAML Auth server in Authentication.

Click Save.

Under Role mapping, create a new rule with username * and select Users role from the list.

Click Save.

Click New URL.

Select User type > Users.

Enter "*/zso" as the Sign-in URL.

In Authentication realm, select User Picks from a list of authentication realm and select the User realm configured for ZSO.

Click Save.

Enable ZSO for Admin Portal

Configure Admin Realm to use SAML Auth Server

Enter a name for realm and select SAML Auth server in Authentication.

Click Save.

Under Role mapping, create a new rule with username * and select Users role from the list.

Click Save.

Click New URL.

Select User type > Administrators.

Enter "*/zso" as the Sign-in URL.

In Authentication realm, select User Picks from a list of authentication realm and select the Admin realm configured for ZSO.

Click Save.

Enable ZSO for Pulse Client

Configure VPN Profile for Pulse Client

Create a New Profile.

Enter a name for the profile.

In IPv4 address assignment, select IPv4 address pool and enter a pool of IP address. For example: 10.10.10.1-100

Click Save.