Integrate Juniper Mist with Zero Trust Network Access

In this topic, you will find general instructions on how to integrate Juniper Mist with Portnox™ Zero Trust Network Access.

Create a Portnox Cloud application configuration

In this step, you will create a configuration in Portnox Cloud that will contain all the information necessary to integrate with Mist.

  1. In a new tab of your browser, open your Portnox Cloud account by accessing the following URL: https://cloud.portnox.com/

    From now on, we will call this tab the Portnox tab.

  2. In the Cloud portal top menu, click on the Zero Trust Resources option.

  3. On the Resources screen, click on the Create resource button.

    1. In the What type of resource is this? section, select the SSO web application option.
    2. In the Authentication protocol section, select the SAML option.

    3. Click on the Next button.
  4. Optional: If you have more than one SAML identity provider configured, select the identity provider in the Select an identity provider to use for this resource section.
  5. In the Resource details section, enter a Resource name and optionally a Description.

    In this example, we used the name Mist for the new application configuration but you can use any name you like.

  6. Keep this browser tab open. You will need it later.

Modify your identity provider configuration to support Mist roles

Mist grants dashboard access based on a role attribute in the SAML assertion. You must change your existing identity provider configuration or create a copy of the identity provider configuration especially for Mist.

Important:
Mist expects the attribute names Role, FirstName, and LastName exactly as shown, including capitalization. Role is required unless you configure a default role through the Mist API. FirstName and LastName are optional, but without them Mist shows ? ? as the user’s name.
Note:
Mist has no page listing SSO users, even users granted an admin-level role. You can only see a user’s name and role after they log in, in Organization > Audit Logs, not in the Administrators page. The Administrators page shows only local accounts and users who were manually invited.
  • If you use an Entra ID IdP configuration, in another browser tab, open the Entra ID SAML application that you created earlier and do the following steps.
    1. Open the Attributes & Claims pane (Enterprise apps > your Zero Trust Network Access application > Single sign-on > Attributes & Claims > Edit).
    2. Click on the Add new claim button. In the Name field, type FirstName, and in the Source attribute field, select the user.givenname attribute. Then, click on the Save button.
    3. Click on the Add new claim button again. In the Name field, type LastName, and in the Source attribute field, select the user.surname attribute. Then, click on the Save button.
    4. Click on the Add a group claim button. In the Group Claims pane, select Groups assigned to the application, set Source attribute to Group ID, in the Advanced options section, activate the Customize the name of the group claim checkbox and type Role, and then click on the Save button.

  • If you use Google Workspace, open your admin console and do the following steps.
    1. Open the SAML attribute mapping pane (Apps > Web and mobile apps > your Zero Trust Network Access application > Configure SAML attribute mapping).
    2. Click on the ADD MAPPING button and add the following mappings: Basic information > First name to FirstName, Basic information > Last name to LastName, and Basic information > Primary Email to Email.
    3. In the Group membership (optional) section, select the Google groups that you want to have access to Mist, and in the App attribute field, type Role. Then, click on the Save button.

Create Mist roles

In this section, you will create roles in Mist that match the role values sent by your identity provider.

Important:
The role name must exactly match the value your identity provider sends in the Role attribute, for example the Object ID of an Entra ID group or the name of a Google Workspace group.
Note:
If your identity provider sends more than one role value for a user, Mist requires every one of them to match a role defined here. By default, if even one value doesn’t match, Mist denies access. When all values match, Mist grants the user the combined (superset) permissions of every matched role. To allow partial matching instead, set the ignore_unmatched_roles option through the Mist API. To grant a fallback role when no values match at all, set the default_role option through the Mist API. Neither option is available in the Mist dashboard.
Note:
If a user signing in through SSO already exists as a local Mist account, Mist does not log the user in directly. Instead, it redirects the user to the Mist login page and asks for the local account’s password, to verify ownership before converting the account to SSO. This verification happens only once per user. After it succeeds, that account becomes an SSO account and subsequent logins go straight through.
  1. In another tab of your browser, open your Mist dashboard and log in with your administrator credentials.

    The dashboard URL depends on the cloud instance your organization uses, for example https://manage.ac2.mist.com/. Use the same URL you normally use to manage your organization.

    From now on, we will call this tab the Mist tab.

  2. In the left-hand side menu, click on the Organization option, and then, in the menu that opens, click on the Settings option.

  3. In the Roles section, click on the Create Role button.

  4. In the Create Role window, in the Name field, enter the role name exactly as sent by your identity provider. Then, select the option that matches the level of access this role should have, select the sites the role should have access to, and click on the Create button.

  5. Repeat the previous three steps for every role that your identity provider can send.

    Note:
    The screenshot shows example roles from both Entra ID and Google Workspace. The Entra ID role is identified by the object ID, while the Google Workspace role is identified by the group name.

Create an IDP in Mist

In this section, you will access your Mist organization settings and create a new identity provider.

  1. In the Mist tab, in the Single Sign-on section, in the Identity Providers pane, click on the Add IDP button.

  2. In the Add Identity Provider window, in the Name field, enter a name for this identity provider, and then click on the Add button.

    Result: The window changes to Create Identity Provider and shows more fields. Mist also generates the ACS URL and Single Logout URL values automatically.

Copy configuration values from the Portnox tab to the Mist tab

In this section, you will copy the values displayed by Portnox Cloud and paste them in the relevant fields in the Create Identity Provider window in Mist.

  1. In the Portnox tab, in the Service details section, click on the  ⧉  icon next to the Identity Provider Entity ID / Audience URI field to copy the value.

  2. In the Mist tab, click on the empty field next to the Issuer label and paste the value copied from Portnox Cloud.

  3. In the Portnox tab, in the Service details section, click on the  ⧉  icon next to the Sign-In URL / SSO URL field to copy the value.

  4. In the Mist tab, click on the empty field next to the SSO URL label and paste the value copied from Portnox Cloud.

  5. In the Portnox tab, in the Certificates > Signing certificates section, click on the  ⋮  icon next to the Active certificate and select the Copy certificate option to copy the certificate.

  6. In the Mist tab, click on the empty field under the Certificate label and paste the value copied from Portnox Cloud.

Copy configuration values from the Mist tab to the Portnox tab

In this section, you will copy the value displayed in the Mist identity provider configuration and paste it in the relevant fields in Portnox Cloud.

  1. In the Mist tab, click on the  ⧉  icon next to the ACS URL field to copy the value to the clipboard.

  2. In the Portnox tab, in the Resource properties section, click on the empty field under the Entity ID / Service Provider Entity URL heading and paste the value copied from Mist.

  3. Click on the empty field under the Assertion Consumer Service (ACS) URL / Reply URL heading and paste the same value.

Finalize the configuration

In this section, you will finalize the configuration in Portnox Cloud and Mist.

  1. Finalize the configuration in the Portnox tab.
    1. In the Portnox tab, click on the OPTIONAL SETTINGS link to show additional fields, and then in the Certificate signing option field, select the Sign SAML assertion and response option.

    2. In the Application Login URI field, enter the same value as the IdP-initiated SSO URL from the Service details section, instead of a direct Mist URL.
      Note:
      This step is required if you want to show this application in the ZTNA Secure Access Portal.
      Warning:
      If users don’t use the ZTNA Secure Access Portal and instead enter the Mist dashboard address directly in their browser for their first ever ZTNA login, that login fails. Mist requires the first login to be IdP-initiated. After users complete their first login through the portal, the plain dashboard address works for them from then on. Alternatively, you can use the dashboard URL in this field, but then you must send users the IdP-initiated SSO URL and instruct them to use it for their first login. After that, they can use the portal.

    3. Optional: Click on the Next button, and in the Policy enforcement section, in the Device risk assessment section, change the setting to Override with custom policy and then select a risk assessment policy if you want to assess risk with this application using a custom risk assessment policy, and in the Access control section, change the setting to Override with custom policy and then select an access control policy if you want to control access to this application using a custom access control policy.
      Note:
      To configure the access control policy, follow the steps in this topic: Create or edit an access control policy. To select the default access control policy, on the Groups screen, select a group that you want to configure the default for, click on the  ⋮  icon at the end of the row that represents the group, and then select the Group policies option. Then, in the ZTNA Resources section, select the policy in the SSO Web resources drop-down menu.
    4. Scroll all the way down to the end of the page, and then click on the Add resource button.

  2. Finalize the configuration in the Mist tab.
    1. Click on the Save button in the Create Identity Provider window.

      Important:
      Test your login with Portnox Zero Trust Network Access in an incognito or private browser window before you rely on it. If the configuration is wrong, you could lock yourself out of Mist.
      Note:
      If a user signing in through SSO already exists as a local Mist account, Mist does not log the user in directly. Instead, it redirects the user to the Mist login page.

Result: You have configured Mist to be accessible using Portnox Zero Trust Network Access.