Integrate the Cisco Meraki dashboard with Zero Trust Network Access

In this topic, you will find general instructions on how to integrate the Cisco Meraki dashboard with Portnox™ Zero Trust Network Access.

Modify your identity provider configuration to support the Meraki dashboard

Meraki SAML integration requires your identity provider to send additional values that identify the username and user role for specific Meraki admin privileges. You must change your existing identity provider configuration or create a copy of the identity provider configuration especially for Meraki.

Note:
You can have use the same identity provider configuration for multiple applications. However, be aware that in such case, other applications will also receive your Meraki user role values. This will not cause any technical issues but you must consider whether you want this information to be shared with other applications.
Important:
Meraki gives an admin role to a user based on the role identifier that it receives via a custom claim. Your user directory must have a field for the role identifier, and each user that needs to use the Meraki dashboard must have this field filled in with the correct role identifier. You must add the same role identifier to the Meraki dashboard configuration. Only users whose role identifier matches a role identifier in the Meraki dashboard can access the dashboard.
  • If you use Entra ID, open your Zero Trust Network Access application configuration and do the following steps.
    1. Open the Attributes & Claims pane (Single Sign-on > Attributes & Claims > Edit) and click on the Add new claim button.

    2. In the Name field, type https://dashboard.meraki.com/saml/attributes/username, and in the Source attribute field, select the user.mail attribute. Then, click on the Save button.

      Note:
      You can use user.userprincipalname instead of user.mail. In most cases, both hold the same value. But for some accounts, such as guest accounts or service accounts, the user principal name can differ from the mail attribute, or it may not be a real email address. Use user.mail as your default choice. Use user.userprincipalname only if some admin accounts in Entra ID have no value in the mail attribute.
    3. Click on the Add new claim button again to create another claim. In the Name field, type https://dashboard.meraki.com/saml/attributes/role, and in the Source attribute field, select a relevant role identifier field from the list. Then, click on the Save button.

      Note:
      You can use any attribute that holds a single value and is not already used for something else, such as user.department or user.jobtitle. If none of the built-in attributes can be used, you can also create a custom attribute for the role identifier, but this is a very complex process which includes creating a custom security attribute in Entra ID, writing your own Azure Function to read this attribute, registering this Azure Function as a custom claims provider in Entra ID, and connecting this custom claims provider to your application, so it is not recommended.
    4. Double-check if your claims include all of the above.

      Note:
      You may have additional attribute mappings in this configuration. They will not influence the integration with Meraki.
  • If you use Google Workplace, open your configuration and do the following steps.
    1. In Google Admin Console, go to Directory > Users. Then, click on the More options button, and select the Manage custom attributes option.

    2. Click on the ADD CUSTOM ATTRIBUTE link.

    3. In the Add custom fields pane, enter a Category (for example, Meraki) and add one attribute: Role. Set Info type to Text, Visibility to Visible to user and admin, and No. of values to Single Value. Then, click on the ADD button.

    4. Go back to the list of users. Then, open a user that needs access to Meraki, click on the ADD ALTERNATE EMAILS option, and scroll down to the category you added in the previous step. Then, click on the  ✎  icon to edit the values and enter the name of the role that you want the user to have.

      Note:
      You can use any names for different roles but you will have to add each of these names to the Meraki configuration later.
    5. Repeat the above step manually for every user that requires access to Meraki.
    6. Open the SAML attribute mapping pane (Apps > Web and mobile apps > your Zero Trust Network Access application > Configure SAML attribute mapping.

    7. Click on the ADD MAPPING button twice and add the following mappings: Meraki > Role to https://dashboard.meraki.com/saml/attributes/role and Basic information > Primary email to https://dashboard.meraki.com/saml/attributes/username. Then, click on the Save button.

      Note:
      You may have additional claims in this configuration. They will not influence the integration with Meraki.

Create a Portnox Cloud application configuration

In this step, you will create a configuration in Portnox Cloud that will contain all the information necessary to integrate with Meraki.

  1. In a new tab of your browser, open your Portnox Cloud account by accessing the following URL: https://cloud.portnox.com/

    From now on, we will call this tab the Portnox tab.

  2. In the Cloud portal top menu, click on the Zero Trust Resources option.

  3. On the Resources screen, click on the Create resource button.

    1. In the What type of resource is this? section, select the SSO web application option.
    2. In the Authentication protocol section, select the SAML option.

    3. Click on the Next button.
  4. Optional: If you have more than one SAML identity provider configured, select the identity provider in the Select an identity provider to use for this resource section.
  5. In the Resource details section, enter a Resource name and optionally a Description.

    In this example, we used the name Meraki for the new application configuration but you can use any name you like.

  6. Keep this browser tab open. You will need it later.

Create your Meraki single sign-on roles

In this section, you will create single sign-on roles in the Meraki dashboard.

  1. In another tab of your browser, open your Meraki dashboard by accessing the following URL: https://dashboard.meraki.com/.

    From now on, we will call this tab the Meraki tab.

  2. In the left-hand side menu, select the Organization > Administrators option.

  3. In the right-hand side pane, click on the SAML tab, and then click on the Create new SAML group button.

  4. In the Group name field, add the name of the user role. Then, click on the Assign role button to assign privileges to this role as needed. Optionally, click on the Add role and scope to add more privileges. Finally, click on the Save button to save this role.
    Important:
    The Group name must exactly match the value assigned to the role claim in your authentication repository, for example, the value entered for the user in the Department or Job title Entra ID field, or in a custom Meraki > Role Google Workspace field.

  5. Repeat the above two steps for all roles that you created in your authentication repository.

    For example, say you use Google Workspace. You have a user named Kosh Naranek. Kosh has the value SuperAdmin in the Meraki > Role field. You also have a user named Ulkesh Naranek. Ulkesh has the value ReadOnlyAdmin in the Meraki > Role field. In this case, you must create two SAML groups in the Meraki Dashboard. The names of these groups must be exactly SuperAdmin and ReadOnlyAdmin. Users with a different value, or no value, in the Meraki > Role field will not be able to access the Meraki Dashboard.

Open the Meraki SAML settings

In this section, you will open the page in the Meraki Dashboard where you can configure SAML integration settings and provide basic information for the SAML integration.

  1. In the Meraki tab, in the left-hand side menu, select the Organization > Settings option.

  2. Scroll down to the Authentication section, and in the SAML SSO field, select the SAML SSO enabled value.

  3. In the SSO Subdomain field, enter the subdomain that you will use to access your SSO integration.
    Note:
    This must be a unique subdomain, not used by any other organization. This subdomain will be prepended to sso.meraki.com to create the URL.

    For example, if you enter the subdomain vorlon, your SSO users will be able to log in by going to https://vorlon.sso.meraki.com/.

  4. Click on the Add a SAML IdP link.

Copy configuration values from the Portnox tab to the Meraki tab

In this section, you will copy the values displayed by Portnox Cloud and paste them in the relevant fields in the Meraki SAML setup section.

  1. In the Portnox tab, in the Service details section, click on the  ⧉  icon next to the Sign-In URL / SSO URL field to copy the value.

  2. In the Meraki tab, click on the empty field under the SSO login URL label and paste the value copied from Portnox Cloud.

  3. In the Portnox tab, in the Certificates > Signing certificates section, click on the  ⋮  icon next to the Active certificate and select the Download certificate option to download the certificate to the local drive.

  4. Open the certificate in your operating system. Then, find and copy its thumbprint value.

    For example:

    • In Windows:

      1. Double-click on the downloaded certificate file and click on the Open button.

      2. In the Certificate window, go to the Details tab, scroll down the list to see the Thumbprint entry, click on it, and then double-click on the value in the field below and press the key combination CTRL + C to copy the value to the clipboard.

    • In macOS:

      1. Double-click on the downloaded certificate file and click on the View Certificates button.

      2. Click on the Details label to show certificate details.

      3. Scroll down to the Fingerprints section, mark the value of the SHA-1 field, and press the key combination Command + C to copy the value to the clipboard.

  5. Manually add colons (:) between each two characters in the fingerprint because Meraki expects the fingerprint in this format.

    You can also use the following scripts that take the fingerprint that you copied and provide you with a fingerprint in the required format:

    • PowerShell:

      ("input_fingerprint" -replace ' ','' -replace '(..)(?!$)','$1:').ToLower()

      where input_fingerprint is the fingerprint that you copied from the certificate.

    • Bash:

      echo "input_fingerprint" | tr -d ' ' | sed 's/../&:/g;s/:$//' | tr 'A-Z' 'a-z'

      where input_fingerprint is the fingerprint that you copied from the certificate.

  6. In the Meraki tab, click on the empty field next to the X.509 cert SHA1 fingerprint label and paste the fingerprint in the colon-separated format.

  7. Click on the Save button in the bottom-right corner of the screen.
  8. Scroll down to the Authentication section, and in the SP Initiated SAML IdP field, select the value equal to your fingerprint pasted in the X.509 cert SHA1 fingerprint field.

Copy configuration values from the Meraki tab to the Portnox tab

In this section, you will copy the values displayed in your Meraki SSO setup section, and paste them in the relevant fields in Portnox Cloud.

  1. In the Portnox tab, in the Resource properties section, click on the empty field under the Entity ID / Service Provider Entity URL heading and type the value: https://your_subdomain.sso.meraki.com, where your_subdomain is the value you entered in the SSO Subdomain field in the previous section.

  2. In the Meraki tab, select the text value next to the Consumer URL field and copy it to the clipboard.

  3. In the Portnox tab, in the Resource properties section, click on the empty field under the Assertion Consumer Service (ACS) URL / Reply URL heading and paste the value copied from Meraki.

Finalize the configuration

In this section, you will finalize the configuration in Portnox Cloud and the Meraki dashboard.

  1. Finalize the configuration in the Portnox tab.
    1. Click on the OPTIONAL SETTINGS link to show additional fields, and then in the Application Login URI field, enter the following value: https://your_subdomain.sso.meraki.com, where your_subdomain is the value you entered in the SSO Subdomain field (the same value that you entered in the Entity ID / Service Provider Entity URL field).
      Note:
      This step is required if you want to show this application in the ZTNA Secure Access Portal.

    2. Optional: Click on the Next button, and in the Policy enforcement section, in the Device risk assessment section, change the setting to Override with custom policy and then select a risk assessment policy if you want to assess risk with this application using a custom risk assessment policy, and in the Access control section, change the setting to Override with custom policy and then select an access control policy if you want to control access to this application using a custom access control policy.
      Note:
      To configure the access control policy, follow the steps in this topic: Create or edit an access control policy. To select the default access control policy, on the Groups screen, select a group that you want to configure the default for, click on the  ⋮  icon at the end of the row that represents the group, and then select the Group policies option. Then, in the ZTNA Resources section, select the policy in the SSO Web resources drop-down menu.
    3. Scroll all the way down to the end of the page, and then click on the Add resource button.

  2. Finalize the configuration in the Meraki tab.
    1. Check the list of administrators in the Meraki Dashboard, and remove any administrator whose email address matches a user that will now log in through SAML.
      Important:
      If an administrator with the same email address already exists in the Meraki Dashboard as a normal (non-SAML) user, that user will not be able to log in through SAML. When this user tries to log in using SAML, Meraki Dashboard will show an empty page with only the word true on it. This is a known bug in Meraki. To fix this, go to the Organization > Administrators > Admins tab, and remove the manually added administrator account with that email address. You can then let the user log in through SAML instead.
      Note:
      We recommend that you keep a break-glass account: a service account with a password, which does not use SAML, and is only used in emergencies. If your SAML configuration ever stops working, you can still use this account to log in and fix the problem. Without it, you would need intervention from Meraki support.
    2. Check the SAML login history to confirm that users can log in correctly.

      Go to Organization > Administrators, click on the SAML tab, and then click on the SAML login history link.

      This page shows every SAML login attempt, both successful and failed. If a login fails because an administrator with the same email address already exists as a non-SAML user, the Errors column will show a message such as Found existing non-SAML user with email kosh@vorlon.com. This is where you can find the exact reason for the failed login shown as true in the browser.

Result: You have configured the Meraki dashboard to be accessible using Portnox Zero Trust Network Access.