Integrate Absolute with Zero Trust Network Access

In this topic, you will find general instructions on how to integrate Absolute with Portnox™ Zero Trust Network Access using the conditional access method.

Create a Portnox Cloud resource configuration

In this step, you will create a configuration in Portnox Cloud that will contain all the information necessary to integrate with Absolute.

  1. In a new tab of your browser, open your Portnox Cloud account by accessing the following URL: https://clear.portnox.com/

    From now on, we will call this tab the Portnox tab.

  2. In the Cloud portal top menu, click on the Zero Trust Resources option.

  3. On the Resources screen, click on the Create resource button.

    1. In the What type of resource is this? section, select the SSO web resource option.
    2. In the Authentication protocol section, select the SAML option.
    3. Click on the Next button.

  4. Optional: If you have more than one SAML identity provider configured, select the identity provider in the Select an identity provider to use for this resource section.
  5. In the Resource details section, enter a Resource name and optionally a Description.

    In this example, we used the name Absolute for the new resource configuration but you can use any name you like.

  6. Keep this browser tab open. You will need it later.

Open your Absolute single sign-on settings

In this section, you will access your Absolute administrative interface and find the single sign-on (SSO) settings.

  1. In another tab of your browser, log in to your Absolute tenant by accessing the following URL: https://ds.absolute.com/. Then, log in with your Absolute administrative credentials.

    From now on, we will call this tab the Absolute tab.

  2. In your Absolute dashboard, click on the Settings option in the bottom-left corner, and then select the Authentication settings option from the menu.

  3. In the Authentication settings pane, in the Single Sign-On section, click on the Set up Single Sign-On button.

  4. In the Set up Single Sign-On pane, in the Name field, enter a name for this configuration.

    In this example, we used the name Portnox Conditional Access, but you can use any name you like.

  5. Click on the Download Metadata link and save the metadata file to the local drive.

    You will need this metadata file later to copy the configuration values to the Portnox tab.

Export metadata from the Portnox tab and upload it in the Absolute tab

In this section, you will export the metadata from Portnox Cloud into a file and import that file with Absolute.

  1. In the Portnox tab, in the SAML metadata section, click on the Download metadata XML file link to download the XML file and save it to your local drive.

  2. In the Absolute tab, click on the Choose File button in the Import Identity Provider Metadata section, and then upload the XML file downloaded from Portnox Cloud.

Copy the configuration values from the metadata file to the Portnox tab

In this section, you will copy the configuration values stored in the downloaded metadata file and paste them in the relevant fields in Portnox Cloud.

Note: Before copying values from the metadata file, you can try the following static values instead:
  • Entity ID: https://namespace.absolute.com/saml2/sp/cc.absolute.com.shib
  • Assertion Consumer Service URL: https://cc.absolute.com/Shibboleth.sso/SAML2/POST
  1. Open the Absolute metadata file downloaded earlier (absolute-metadata.xml) in a browser.

    For example, in Windows, simply double click on the downloaded file.

  2. In the metadata content, find the <md:EntityDescriptor> element and its entityID attribute, and then copy its value (without the quotes) using your operating system’s copy shortcut.

  3. In the Portnox tab, in the Resource properties section, click on the empty field under the Entity ID / Service Provider Entity URL heading and paste the copied value.

  4. In the metadata content, find the <md:AssertionConsumerService> element with the Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" attribute. Copy the value of its Location attribute (without the quotes).

  5. In the Portnox tab, in the Resource properties section, click on the empty field under the Assertion Consumer Service (ACS) URL / Reply URL heading and paste the copied value.

Finalize the configuration

In this section, you will finalize the configuration in Portnox Cloud and Absolute.

  1. Finalize the configuration in the Portnox tab.
    1. Optional: In the Policy enforcement section, in the Device risk assessment section, change the setting to Override with custom policy and then select a risk assessment policy if you want to assess risk with this application using a custom risk assessment policy, and in the Access control section, change the setting to Override with custom policy and then select an access control policy if you want to control access to this application using a custom access control policy.
    2. Scroll all the way down to the end of the page, and then click on the Save and Close button.

  2. Finalize the configuration in the Absolute tab.
    1. Click on the Save button.

      Important: Before you close your Absolute tab, open your Absolute tenant again in an incognito/private browser window and test if you can log in with Portnox Zero Trust Network Access. The configuration applies to all users and if you configure it wrongly, nobody will be able to log in to Absolute. In case of trouble, click on the Disable Single Sign-On button and then begin troubleshooting.

Result: You have configured Absolute to be accessible using Portnox Zero Trust Network Access.