Integrate Sophos Fusion with Zero Trust Network Access

In this topic, you will find instructions on how to integrate Sophos Fusion with Portnox™ Zero Trust Network Access using OpenID Connect (OIDC).

To complete this integration, you need:

  • A Sophos Fusion administrator account with the Super Admin role.

  • Access to the public DNS settings of the domain used by your Sophos Fusion administrators.

  • An OIDC identity provider configured in Portnox Cloud, for example: Entra ID with OIDC, Google Workspace with OIDC, or Okta with OIDC.

Create a Portnox Cloud resource configuration

In this section, you will create a configuration in Portnox Cloud that will contain all the information necessary to integrate with Sophos Fusion.

  1. In a new tab of your browser, open your Portnox Cloud account by accessing the following URL: https://cloud.portnox.com/

    From now on, we will call this tab the Portnox tab.

  2. In the Cloud portal top menu, click on the Zero Trust Resources option.

  3. On the Resources screen, click on the Create resource button.

    1. In the What type of resource is this? section, select the SSO web resource option.
    2. In the Authentication protocol section, select the OIDC option.

    3. In the Application logo section, select one of the logos from the list, or select the Upload a custom logo option and then click on the Upload image button to upload a logo for the application.

      The logo is used in the Secure Access Portal.

    4. Click on the Next button.
  4. Optional: If you have more than one OIDC identity provider configured, select the identity provider in the Select an identity provider to use for this resource section.
  5. In the Resource details section, enter a Resource name and optionally a Description.

    In this example, we used the name Sophos for the new resource, but you can use any name you like.

  6. In the Resource properties section, in the Allowed Callback URI field, enter the following value: https://federation.sophos.com/login/callback.

  7. Keep this browser tab open. You will need it later.

Verify your domain in Sophos Fusion

In this section, you will prove to Sophos Fusion that you own the domain used by your Sophos Fusion administrators.

Note:
Sophos Fusion uses federated sign-in only for verified domains. If your domain is already verified, skip this section.
Note:
You can assign each domain to one identity provider only. To use a domain that is already assigned, remove it from the other identity provider first.
  1. In another tab of your browser, open the Sophos Fusion administrative interface by accessing the following URL: https://fusion.sophos.com

    From now on, we will call this tab the Sophos tab.

  2. In the top-right corner, click on the  ⚙  icon.

  3. In the left-hand side menu, in the PLATFORM section, click on the Verify Domains option.

  4. On the Verify domains screen, click on the Add domain button.

  5. In the Add domain window, enter your domain in the Domain Name field and optionally a Description. Then, click on the Save button.

  6. In the Verify domain ownership window, click on the Copy button next to the TXT value field.

  7. In your DNS provider’s administrative interface, add a TXT record for your domain. Use the copied value as the record value.

    The record goes on the domain itself (the value shown in the TXT record name field). Most DNS providers represent this with @ or an empty name field. DNS changes can take up to 24 hours to propagate.

  8. In the Sophos tab, click on the Verify button.

    If the DNS record has not propagated yet, click on the Cancel button. The domain stays on the list. When the record propagates, click on the Verify domain ownership link in the Verification Status column, and then click on the Verify button.

    The Verification Status column shows Verified and the date.

Add Portnox as an identity provider in Sophos Fusion

In this section, you will create an OpenID Connect identity provider in Sophos Fusion and copy values from Portnox Cloud into it.

  1. In the Sophos tab, in the left-hand side menu, in the ACCESS CONTROL section, click on the Sign-in and Identity option.

  2. On the Federated Identity Providers tab, click on the Add identity provider button.

  3. In the Add identity provider window, configure the following settings:

    1. In the Name field, enter a name for the identity provider, and optionally a Description.
    2. In the Type drop-down menu, select the OpenID Connect option.
    3. In the Vendor drop-down menu, select the Other (Please specify) option.
    4. In the Vendor name field, enter: Portnox ZTNA.
  4. In the Portnox tab, click on the  ⧉  icon next to the Client ID field to copy the value to your clipboard.

  5. In the Sophos tab, paste the copied value into the Client ID field.
  6. In the Portnox tab, click on the  ⧉  icon next to the Issuer field to copy the value to your clipboard.

  7. In the Sophos tab, paste the copied value into the Issuer field.
  8. In the Portnox tab, click on the  ⧉  icon next to the Authorization Endpoint field to copy the value to your clipboard.

  9. In the Sophos tab, paste the copied value into the Authz endpoint field.
  10. In the Portnox tab, click on the  ⧉  icon next to the JWKS endpoint field to copy the value to your clipboard.

  11. In the Sophos tab, paste the copied value into the JWKS URL field.

  12. In the Step C: Configure domains section, select your verified domain from the drop-down menu.

    You can assign each verified domain to one identity provider only. Domains assigned to another identity provider don’t appear in the drop-down menu.

  13. In the Step D: Confirm identity provider MFA enforcement section, select the IdP enforced MFA option.

    With the other option, Sophos Fusion asks users for Sophos Fusion multi-factor authentication after Portnox ZTNA authentication.

  14. Click on the Save button.

    Sophos Fusion saves the identity provider with the status Off.

Finalize the configuration

In this section, you will finalize the configuration in Portnox Cloud and Sophos Fusion.

  1. Finalize the configuration in the Portnox tab.
    1. Click on the OPTIONAL SETTINGS link to show additional fields, and then in the Application Login URI field, enter the following value: https://fusion.sophos.com.
      Note:
      This step is required if you want to show this application in the ZTNA Secure Access Portal.
    2. Optional: Click on the Next button, and in the Policy enforcement section, in the Device risk assessment section, change the setting to Override with custom policy and then select a risk assessment policy if you want to assess risk with this application using a custom risk assessment policy, and in the Access control section, change the setting to Override with custom policy and then select an access control policy if you want to control access to this application using a custom access control policy.
      Note:
      To configure the access control policy, follow the steps in this topic: Create or edit an access control policy. To select the default access control policy, on the Groups screen, select a group that you want to configure the default for, click on the  ⋮  icon at the end of the row that represents the group, and then select the Group policies option. Then, in the ZTNA Resources section, select the policy in the SSO Web resources drop-down menu.
    3. Scroll all the way down to the end of the page, and then click on the Add resource button.

  2. Finalize the configuration in the Sophos tab.
    1. On the Federated Identity Providers tab, click on the name of the identity provider that you created.
    2. In the top-right corner, click on the Turn on button.

      The Status field shows On.

Result: You have configured Sophos Fusion to be accessible using Portnox Zero Trust Network Access.