Cookbook for Ivanti Neurons

9 min

Integrating Ivanti Neurons as a SAML Service Provider with Ivanti Access

Ivanti Neurons can work as SAML service provider. Use Okta or any appropriate IDP and configure a Customer SP federation pair on Ivanti Access using the dedicated Ivanti Neurons SP catalog item and your chosen IDP.

This cookbook considers Okta as the identity provider.

Custom Rules: You can apply custom conditional access policies to this federation. For example, you can configure Network Rules in Ivanti Access to restrict user logins for Ivanti Neurons to a specific IP range.

Before you begin

Ensure your global SAML configuration is correct.

Ensure you have the required administrative privileges in Ivanti Neurons, Ivanti Access, and Okta.

For configuring an external authenticator provider in Neurons, see External Authentication (SSO).

Phase 1: Preparing Metadata

Creating the Identity Provider metadata record in Ivanti Neurons

Navigate to the SSO/SAML configuration section.

Select Other IdP to create a new external authentication provider.

Select Enabled Signed Requests and then click Apply Changes.

Select Download SP metadata.

Upload the Access IdP metadata. For further details, refer Phase 2 and Phase 3.

Click Continue.

Encrypted assertions are not supported in Ivanti Access.

Phase 2: Configuring the Federated Pair on Ivanti Access

Setting up the Federation Pair

Navigate to Profile > Federation > Add Pair.

From the service provider catalog, select the dedicated Ivanti Neurons tile.

Do not use the 'Custom SAML' option; selecting the Neurons tile ensures proper analytics tracking.

Upload the Ivanti Neurons 'SAML metadata.xml' that you downloaded in the previous phase.

Click Next.

Select Okta as the identity provider from the catalog.

Upload the Okta Metadata.

Click Done.

Phase 3: Finalizing the Integration

Updating Ivanti Neurons to federate with Ivanti Access

Edit the metadata provider you created earlier.

Update the configuration to point to the Access IDP Metadata (Upload to SP) option.

Ensure that the Identity Provider Entity ID is updated to the newly generated Access URL.

Updating Okta configuration

Edit the application configuration for this setup to recognize the Ivanti Access integration as the trusted entity routing the authentication.

While configuring Okta Console, as listed in Okta Authentication (SAML), ensure to update the attributes in Configure SAML > Attribute Statements, as follows:

(Mandatory) Name: 'email', Value: 'user.email'. Click Add Another.

(Optional) Name: 'given_name', Value: 'user.firstName'. Click Add Another.

(Optional) Name: 'family_name', Value: 'user.lastName'.

The data in the above fields is case-sensitive.

Publish the Profile

Once all configurations and rules are set, publish the profile in Ivanti Access to apply the changes.

Return to the Ivanti Neurons admin portal. Click Continue > Validate Settings. The validation takes place automatically. You will receive a confirmation screen if login is successful.

(Optional) Configuring Conditional Network Rules

If you need to restrict Ivanti Neurons access to specific networks:

In the Ivanti Access admin portal, open your newly created Ivanti Neurons federation pair.

Navigate to the Custom Rules option.

Select Network Rule.

Define the permitted IP range to restrict login access to those specific IPs.

Click Save.