Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Zscaler Private Access

Create an integration to manage access to a ZPA instance

Zscaler Private Access (ZPA) is a cloud-native service that provides secure, zero-trust access to private applications running in the public cloud or a data center.

Through this integration, Apono discovers Zscaler ZPA access policy rules and uses them to manage access. When Apono grants access, it creates a temporary access policy rule by copying the scope of the selected rule and modifying the user assignment for the requester. The requester receives access to all application segments allowed by the selected rule.

Limitations

Before you integrate Zscaler ZPA, review the following limitations:

  • Zscaler limits each ZPA tenant to 2,000 access policy rules. Apono creates one temporary access policy rule for each active grant, and these rules count toward that limit. If your tenant is close to the limit, contact Zscaler Support.

  • The ZPA API allows 20 GET requests and 10 POST, PUT, or DELETE requests per 10-second interval from a single IP address. Apono queues requests and honors the Retry-After header, so grants and revokes may take longer to complete when many operations run through the same connector at the same time.

  • Apono reports a grant as successful after the access policy rule is created. However, Apono cannot verify that the end user can reach the application. Access may still be denied by a higher-priority block rule, ZPA context criteria such as location or device posture, or an unavailable Zscaler Client Connector.

  • Apono discovers only enabled ALLOW access policy rules. Disabled rules and block rules are not discovered and cannot be used in access flows.

  • The integration only supports the ZPA Legacy API. Tenants that use OneAPI with Authentication Service (formerly ZIdentity) are not supported.

  • Microtenants are not supported. Apono discovers and manages access policy rules in the default tenant only.

  • Each integration supports a single identity provider (IdP). To manage access policy rules for multiple IdPs, create a separate integration for each IdP.

Prerequisites

Item
Description

Apono Connector

On-prem connection serving as a bridge between a Zscaler instance and Apono:

Zscaler ZPA Account Access

Zscaler ZPA account with permission to create admin roles and API keys

Zscaler Customer ID

Unique Zscaler identifier used to scope API requests to your tenant

Follow these steps to obtain the customer ID from the ZPA Admin Portal:

  1. From the navigation, click Configuration & Control > Public API > API Keys. The API Keys page appears.

  2. Click the Menu icon.

  3. Copy the Customer ID.

Obtain integration values

Apono identifies the requester for the access policy rule by email address. The requester's email address in Apono must match the email stored in the configured ZPA IdP. Apono does not map between different user identities. To configure this matching behavior, identify the IdP, determine whether its policy attributes use SCIM or SAML, and identify the exact attribute that contains the user's email address.

These values are configured in Apono as the IdP, Policy Attribute Protocol, and Policy Email Attribute.

Determine the Policy Attribute Protocol

Follow these steps in the ZPA Admin Portal:

  1. From the side navigation, click Authentication > User Authentication > IdP Configuration. The IdP Configuration page appears.

  2. From the Name column, identify the IdP that provisions your users and copy its display name. Use this value for the IdP setting in the Apono integration config.

  3. Open the IdP configuration for editing. Use the following table to determine the Policy Attribute Protocol value for the Apono integration.

IdP Configuration
Policy Attribute Protocol

SAML Attributes for Policy: Enabled

and

SCIM Attributes for Policy: Disabled

SAML

SAML Attributes for Policy: Disabled

and

SCIM Attributes for Policy: Enabled

SCIM

Obtain the Policy Email Attribute

SAML Attributes and SCIM Attributes pages

For the Apono integration, the Policy Attribute Protocol and Policy Email Attribute values must correspond to the same IdP and attribute type. If the protocol is SCIM, use the email attribute from that IdP's SCIM Attributes list. If the protocol is SAML, use the email attribute from that IdP's SAML Attributes list.

A mismatched protocol or attribute can prevent the access policy rule from matching the requester, causing the grant to fail without an error.

Follow these steps to obtain the policy email attribute:

  1. Open the attribute list. Expand SCIM or SAML below for instructions.

SCIM

  1. From the side navigation, click Authentication > User Authentication > SCIM Attributes. The SCIM Attributes page appears.

  2. From the dropdown menu, select the same IdP that was opened to determine the policy attribute protocol. The IdP attributes appear.

SAML

  1. From the side navigation, click Authentication > User Authentication > SAML Attributes. The SAML Attributes page appears.

  2. Filter the list by the name of the same IdP that was opened to determine the policy attribute protocol.

  1. Copy the value from the SCIM Attribute or SAML Attribute column that contains the user email address, for example emails.value (SCIM) or email-saml-test (SAML).

Do not copy the display name shown in the ZPA Admin Portal.

Create Zscaler ZPA credentials for the Apono connector

You must create API credentials in your ZPA Admin Portal for the Apono connector. The API key must be assigned a role that can manage access policy rules and read the IdP attribute configuration.

Policy Management Access Control in Zscaler ZPA

Follow these steps to obtain the credentials:

  1. From the side navigation, click Configuration & Control > Administration Control > Roles tab.

  2. Click + Add. The Add Role page appears.

  3. Enter a descriptive Name for the role, such as Apono Connector.

  4. (Optional) Enter a Description for the role.

  5. Under Access Control, click Enable for Policy Management. The section expands.

Leave all other Access Control scopes disabled.

  1. Verify the following Policy Management permissions are set.

These are the default settings. Other permissions can be adjusted to align with your organization's policies.

Permission
Value

IdP Configuration

Read Only

Policies

Full

SAML Attributes

Read Only

SCIM Attributes

Read Only

  1. Click Save.

  2. Click Configuration & Control > Public API > API Keys. The API Keys page appears.

  3. Click + Add.

  4. Select the role created in steps 1-7.

  5. Click Save. The Client Secret pop-up window appears.

  6. Copy and save the Client Secret.

Zscaler only displays the client secret once.

  1. Close the pop-up window.

  2. Copy the Client ID.

  3. Using the client secret (step 12) and client ID (step 14), create a secret for the Apono connector. Use the following key-value pair structure when generating the secret. Be sure to replace <ZPA_CLIENT_ID> and <ZPA_CLIENT_SECRET> with the actual values.

lightbulb

You can also input the API credentials directly into the Apono UI during the integration process.

Integrate Zscaler ZPA

You can also use the steps below to integrate with Apono using Terraform.

In step 12, instead of clicking Confirm, follow the Are you integrating with Apono using Terraform? guidance.

Follow these steps to complete the integration:

  1. On the Catalog tab, click Zscaler ZPA. The Connect Integration page appears.

  2. Under Discovery, select one or multiple resource types.

Apono automatically discovers and syncs all the instances in the environment. After syncing, you can manage access flows to these resources.

  1. Click Next. The Apono connector section expands.

  2. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

If the desired connector is not listed, click + Add new connector and follow the instructions for creating a connector (AWS, Azure, GCP, Kubernetes).

  1. Click Next. The Integration Config section expands.

  2. Define the Integration Config settings.

    Setting
    Description

    Integration Name

    Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow

    Customer ID

    (Required) Unique Zscaler identifier used to scope API requests to your tenant

    Policy Attribute Protocol

    (Required) Identity attribute protocol Apono uses when writing access policy rules

    Options:

    • SCIM

    • SAML

    This value must match how the IdP provides the email attribute used to identify requesters.

    Policy Email Attribute

    (Required) Exact attribute value that contains the user's email address

    IdP

    (Required) Display name of the identity provider Apono uses to match requester

    This must exactly match the name as it appears under IdP Configuration in the ZPA Admin Portal.

  3. Click Next. The Secret Store section expands.

  4. Associate the secret or credentials.

If you select the Apono secret manager, enter the values of the Client ID and Client Secret.

  1. Click Next. The Get more with Apono section expands.

  2. Define the Get more with Apono settings.

    Setting
    Description

    Credential rotation period (in days)

    (Optional) Number of days after which the database credentials must be rotated

    Learn more about the Credentials Rotation Policy.

    User cleanup after access is revoked (in days)

    (Optional) Defines the number of days after access has been revoked that the user should be deleted

    Learn more about Periodic User Cleanup & Deletion.

    Custom Access Details

    (Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.

    Integration Owner

    (Optional) Fallback approver if no resource owner is found Follow these steps to define one or several integration owners:

    1. From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.

    2. From the Value dropdown menu, select one or multiple users or groups.

    NOTE: When Resource Owner is defined, an Integration Owner must be defined.

    Resource Owner

    (Optional) Group or role responsible for managing access approvals or rejections for the resource Follow these steps to define one or several resource owners:

    1. Enter a Key name. This value is the name of the tag created in your cloud environment.

    2. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.

    NOTE: When this setting is defined, an Integration Owner must also be defined.

  3. (Recommended) Click Test Integration to validate the integration.

Test Integration is available after you have entered or selected values for all required integration fields.

During the test, Apono runs the following validation checks:

  • Connectivity: The connector can reach the integration.

  • Configuration: The integration is set up correctly.

  • Authentication: The credentials are valid.

  • Discovery: Resources can be fetched.

The Test Validation checklist shows the result of each check.

If a check fails, Apono identifies the failed check and highlights the fields that need correction.

  1. Click Confirm.

💡Are you integrating with Apono using Terraform?

If you want to integrate with Apono using Terraform, follow these steps instead of clicking Confirm:

  1. At the top of the screen, click View as Code. A modal appears with the completed Terraform configuration code.

  2. Click to copy the code.

  3. Make any additional edits.

  4. Deploy the code in your Terraform.

Refer to Integration Config Metadata for more details about the schema definition.

Usage

Use Zscaler ZPA access policy rules as resources in access flows. Apono creates and removes temporary access policy rules to provide time-bound access according to the approval and provisioning rules defined in the flow.

Access policy rules created in ZPA appear in Apono after the next discovery cycle completes.

Follow the guidance in these articles to define Zscaler ZPA resources in an access flow:

PreviousF5 Network
NextDevelopment Tools

Last updated

Was this helpful?