Chromebook SSO
Nowadays in education sectors, especially in colleges and universities, the students
are given Chromebooks for their research work related to the projects they have been assigned.
Beginning with firmware version 17.5, Sophos XG introduces the Chromebook UserID app
that is available on the Chrome Webstore which is designed to do transparent SSO for Chromebook
users.
G Suite (formerly known as Google Apps) is a popular cloud-based platform wherein you
can create email accounts for your organization's domain.
It also offers you additional professional services such as online storage, shared calendar,
google hangouts, google spreadsheets and many more.
The Pre-requisites of this feature are : > 17.5 GA or above firmware version on the
XG device.
> A G-suite admin account to manage and configure the chromebook userID application.
> A chromebook device.
> An AD server having the same domain as that of the G-suite admin account
> and lastly the Users in that AD server should have their email IDs the same as in the g-suite
domain
So for this demo video, we have registered the domain sophos-se.com with G-suite and
here we can see the network setup.
An XG135 sits in front of an AD server and a Chromebook which are both connected to its
LAN network.
Let us have a look at th e configuration steps needed on the XG device in order to enable
Chromebook SSO:
Authentication requests coming from the Chromebook UserID app installed on Chromebook will be
verified with the AD server for the purpose of validation by the XG device, so we will
integrate the AD server with the XG device by navigating to:
Authentication > Servers > and then click on 'Add' to configure an Active Directory
authentication server.
In the services tab, the same AD server needs to be selected for the firewall authentication
methods as well.
The next step would be to enable Chromebook SSO for LAN zone.
This can be configured by Navigating to Administration > device access and make sure that tick mark
is enabled for Chromebook SSO authentication for the LAN zone.
At the moment, Chromebook SSO v1.0 is supported for on-premise only, so the users need to
be connected to an Internal Network.
Users connecting from the WAN zone will not benefit from this feature.
The communication between the XG firewall and Chromebook UserID app agent happens via
a TLS connection.
So in order to trust and validate this communication, we need to create a self-signed certificate
on the XG.
Navigate to Certificates > Certificates and click on 'Add' to generate a self-signed.
The certificate ID would be the internal IP of the XG device or an FQDN that resolves
to the internal IP of the XG.
You need to select your region and fill in the other relevant fields as well.
Once the certificate is created, we navigate to authentication>services and scroll down
to the Chromebook SSO option to configure the Chromebook SSO feature.
Enable the feature and then enter the domain name of the organization.
Enter the port number and then select the recently created self-signed certificate.
Now in order to allow authentication of the users and manage their web and application
traffic we will create 2 firewall rules by navigating to PROTECT>Firewall and then clicking
on the Add Firewall Rule button.
The first firewall rule is to allow only built-in Google FQDN groups so that the Chromebook
device can communicate with G-suite for the initial login process.
The second firewall rule is to allow users to authenticate on the XG firewall.
We also need to apply the required web filter and application control policy.
Both the rules are placed in the LAN_to_WAN group.
Now we have completed the configuration steps on the XG firewall side.
On the AD server, there is no need to install any kind of software, however you need to
make sure that the users email IDs match the domain name that is used in the G-suite account.
In our example, we have configured a domain named Sophos-se.com and we can see that the
user Daniel has an email address at the same domain name.
The XG firewall also checks the email ID parameter when it tries to validate an authentication
request with an AD server.
Finally let us have a look at the configuration steps needed on the G-suite admin account:
From the G-suite admin account, you can upload the configuration and also provision the auto-installation
of the Chromebook userID app.
You can also upload the CA certificate.
First you need to sign in to your G-suite admin console.
Then go device management > chrome management and click on app management
Search for the Sophos chromebook userid app, click on it and you can see the user setting
and public Sessions settings.
First, we go to the user settings, and you can see the hosted domain.
Select the domain and then you can see the settings that we have to allow and the option
to upload a configuration file.
Starting with the 17.5 MR-3 firmware and onwards, this json config file can be directly downloaded
from the XG webUI by navigating to Authentication >Services and scrolling down to the Chromebook
SSO section.
Once the json config file is uploaded we will save the configuration
and then repeat the same steps for the public session settings.
As you can see, the Sophos Chromebook User id app is now configured.
Since we have created a self-signed certificate in the XG firewall, we need its CA certificate
file for trust and validation of the certificate.
We can also use it for SSL inspection.
So now we download the CA certificate form the XG firewall
Under XG showing the Default certificate download video
Now, we can install the CA certificate from the XG firewall in our G-suite admin account
and for that we need to: Go to Device Management > Networks and click
on Certificates.
Select 'Add Certificate' and upload the CA certificate file that was downloaded from
the XG Firewall.
Enable the tick mark for 'Use this certificate as an HTTPS certificate authority'.
47.
So this completes our configuration of the G-suite account.
Now let's see how the Chromebook SSO mechanism would look like on a user's chromebook device:
A user will sign in with their domain credentials that are hosted in a G-suite account.
Here we are using Daniel's mail id and the password.
After a few seconds, we can see a notification window that is displayed by the Sophos Chromebook
userID app.
It notifies us that the user Daniel has successfully logged in.
Since the Chromebook userID app is automatically installed during the login process, you can
check the configuration by searching for this app by name.
Once you click on settings, you can verify the IP address and other parameters
and also click on the Test connection button to confirm the connectivity with G-suite
and the XG firewall.
On the XG firewall, we can see a new Live user, Daniel, logged in with chromebook SSO
mechanism.
So in this way, you can make use of the Chromebook SSO authentication feature starting from version
17.5 and onwards, for managing the chromebook users' traffic effectively.