:orphan: ******************************* Sentry SSO with Juniper ******************************* """""""""""""""""""" Introduction """""""""""""""""""" This article explains how to integrate a Juniper SSL VPN with Sentry. If focusses on the setting up of Sentry and the modification of the login pages to support the Sentry integration. It assumes knowledge of how to configure the Juniper to use Sentry as a RADIUS authentication server. Details of these elements can be found in the existing integration guides `Category:Juniper `_ For this integration it is recommended that the Swivel Radius server is the only authentication required for this realm. """""""""""""" Overview """""""""""""" The integration works by 1. configuring the Juniper login page to redirect the user to Sentry to authenticate 2. user authenticates at Sentry 3. user is redirected back to the Juniper login page with a claim 4. Juniper login page is submitted with username and claim 5. Username and claim are validated via RADIUS 6. User gains access Therefore the following steps are required 1. Configure Juniper Login 2. Configure Sentry to work with Juniper login page 3. Configure Sentry to accept RADIUS requests from Juniper """""""""""""""""""""""" Configure Juniper Login """""""""""""""""""""""" To modify the login pages download the sample.zip file from your Juniper and make the required changes to LoginPage.thtml. If you also wish to support mobile devices you will need to make the same changes to the other login pages, eg LoginPage-mobile-webtoolkit.thtml **sample.zip** can be found on Upload Custom Sign-In Pages, which can be found on Signing-in -> Sign-in Pages -> Upload Custom Pages... There you will be able to see Sample Templates Files on the right side corner as shown below: .. image:: images/Integration/SSO/Juniper/1000px-SampleTemplate.png In order to make the Juniper page work in the desired way once the page has loaded the page must detect if the user has been redirected to this page from the Sentry Auth Manager or if the user have come directly. If the user has come directly they need to be redirected to Sentry Auth Manager. If they have been directed from Sentry Auth Manager the login form needs to be populated and submitted. This is the required snippet that needs adding to the head (eg between the and tags) section of the login pages. The only modification required is to change SENTRYURL for the actual public url of your sentry install. Note the **applicationNameNoSAML=JuniperVPN** This is important as this application name must match the settings on Sentry .. code-block:: console """"""""""""""""""" Configuring Logout """"""""""""""""""" So that when a user logs out of the Juniper they are also logged out of their Sentry session, the Juniper logout pages need to redirect the user to the Sentry single Logout page. This is a simpler version of the modifications made to the login page. The following code needs adding to the page in the logout.thtml file (and mobile device equivalents) .. code-block:: console hostnamectl set-hostname """""""""""""""""" Configure Juniper """""""""""""""""" After you have set up the login and logout pages you should upload them to Juniper (as a zip file) like on the screen here `Sentry SSO with Juniper#Configure Juniper Login `__. After you have uploaded the pages, you should configure the Authentication Realms for the new pages that you have created, to do so you have to click on the Signing In from the left menu. You will be shown the page as below: .. image:: images/Integration/SSO/Juniper/1000px-SigningInJuniperPage.png You have to click on the User URL and select the realm from the available realms box by clicking on it and clicking Add-> button. Refer to the screenshot below. .. image:: images/Integration/SSO/Juniper/1000px-AddingRealmToURLJuniper.png You have to click on your Authentication Realm which you should have set for your user URL. .. image:: images/Integration/SSO/Juniper/1000px-RoleMappingJuniper.png After clicking on the Authentication Realm you should click on Role Mapping and add a new rule by clicking New Rule In the rule you have to set a rule like on the screenshot below. This rule will assign the users their role for your Juniper network. .. image:: images/Integration/SSO/Juniper/RoleMappingRuleJuniper.png After setting up Juniper you should be able to proceed by setting up the Sentry Auth Manager. """"""""""""""""""""""""" Configuring Sentry Login """"""""""""""""""""""""" The Juniper VPN needs to be added to Sentry as an Application. The following entries are required. Name This must match the name in the redirect url, eg JuniperVPN * Service Provider SwivelVPN. Indicates this is a VPN integration * Points Number of points required to access the VPN, refer to Sentry User guide * Endpoint URL This is the URL of the Juniper login page configured to work with Sentry * Entity ID Should match Name. """""""""""""""""""""""""" Configuring Sentry RADIUS """""""""""""""""""""""""" To complete the integration the Juniper VPN must be added as a NAS on the Sentry server. The key settings are * Identifier Must match the Name on Sentry login, eg JuniperVPN * Hostname Must match IP of Juniper VPN Two stage auth, Check Password with repository should be set to NO """" SSO """" For RADIUS VPN applications the login page will be displayed although Sentry has been configured with SSO enabled. That attribute just applies for SAML applications. """""""""""""""""""""""""""""""""""""""" Authentication with AD/LDAP and Radius """""""""""""""""""""""""""""""""""""""" To be able to authenticate with both AD/LDAP and Radius when logging in you have to add few minor changes. You have to modify the script which you have added at this step **Configure Juniper Login** You have to uncomment two lines: .. code-block:: text //$('[name=user#2]').val(usernamePassedIn); //$('[name=password#2]').val(claimPassedIn); by removing double forward slashes in front of the $ sign, so it would look like below: .. code-block:: text $('[name=user#2]').val(usernamePassedIn); $('[name=password#2]').val(claimPassedIn); And you have to change the password line above the uncommented code from. .. code-block:: text $('[name=password]').val(claimPassedIn); To the line below, in the password field we will pass now the password and the claim in the password#2 which we have uncommented above. .. code-block:: text $('[name=password]').val(passwordPassedIn); When you have updated the page, you have to re-upload it by following the same steps like previously on **Configure Juniper Login** After uploading the the index page you have to change settings on your authentication realm to do so, you have to select your authentication realm and first to add the authentication server to be your AD/LDAP. After selecting the authentication server you should select "Additional authentication server" check box and select a previously created Radius server authentication method. The Authentication Realm settings should look similar to the once on the screenshot below: .. image:: images/Integration/SSO/Juniper/1000px-JuniperADandRadius.png """""""" Testing """""""" * Goto to Juniper login url * User redirected to Sentry, user should be prompted for credentials * Supply credentials Should see Sentry logs including .. code-block:: text Login successful for user: username SSO_CLAIM_CREATED_FOR_USER, username * User should be redirected to Juniper VPN * User should gain access Logs should include .. code-block:: text JuniperVPN:Processing user username as channel CLAIM JuniperVPN:Login successful for user: username