Configure Browser-based Access for Private Apps - Netskope Technical Documentation

This article primarily covers the configuration and setup pertaining to Reverse Proxy browser-based private app access (referred to throughout this document as Browser Access).

Browser Access is an additional method through which users can access enterprise internal web applications over HTTP/HTTPS. Additionally, it also supports access to non-web applications, including RDP and SSH, with the AnyApp feature.

Prerequisites

You must have an active Identity Provider (IdP) account and have privileges to modify settings in your IdP account that will direct traffic to Netskope.

Browser-based Access requires that the hostname in the originating HTTP request matches the hostname expected by the application server. Browser Access supports HTTP/1.1, TLS 1.2, and TLS 1.3. HTTP/2 and HTTP/3 are not supported.

Browser-based Access is activated by a feature flag. Contact your Netskope sales representative or Netskope support team to enable this feature for your tenant.

Important

Browser-based Access is not offered for applications accessed through China PoPs.

Workflow

Create a SAML Reverse Proxy account in the Netskope UI, and then update your IdP account with the Netskope ACS URL and Audience URL.
Enable Browser Access for a Private App.
Create a Real-time Protection policy to grant users browser access to Private Apps.

Create a SAML Account for Browser-based Access

You will need your IdP SSO URL and certificate to complete these steps.

Log in to the Netskope UI.
Go to Settings > Security Cloud Platform and click SAML (under Reverse Proxy).
Click Add Account.
In the New Account window, enter a name for the account.
Select Private Apps from the Application dropdown list.
Enter these parameters:
- IdP SSO URL: Enter your IdP SSO URL.
- IdP Certificate: Enter your IdP certificate.
(Optional) Alternate User Id Field: Netskope looks at the NameID field in the SAML assertion to get the user identity. If you would like to use another field for user identification, type the name of the SAML attribute in this field. Select the Status toggle to enable or disable the IdP service.
Click Save and View Netskope Settings to see the URLs for this account. Copy the Browser Access ACS URL and Audience URL to use in your IdP account. Update your IdP account with these URLs before proceeding.

Note

NPA Browser-based Access supports configuration of multiple SAML accounts, extending support for multiple IdPs. Go here for further information.

Enable Browser-based Access for a Private App

These instructions are for new and existing Private Apps.

Go to Settings > Security Cloud Platform > App Definition and click Private App Segments.
Click New Application Segment to create a new private app, or select an existing app (and jump to step 4).
Enter a meaningful app name in the Application Name field.
For Access Method, select Browser.
Enter the Host domain in the Destination field (like jira.site.io). The Destination field supports the following syntax: (jira.site.io). Only one host can be added. Browser-based Access does not support wildcards in host names. Next add a TCP port number.
After adding the hostname and port, the Public Host URL is displayed. This is the URL by which properly authenticated users can access the private app. You can copy the public host name by clicking the copy icon .
Select HTTP or HTTPS. For HTTPS, the private app must either use a certificate that is signed by a trusted certificate authority, or you must select the Trusted self-signed certificate option.
Note
Netskope supports self-signed trusted root certificates. Cross-signed root certificates are not supported in the certificate chain file. To learn more, go here.
A Private App can be accessed via a browser in two ways:
- Using the generated hostname from the Public Host field.
  Note
  You can use the public host name for your custom host name in your DNS system. Create a DNS record, select the CNAME type, and then add your public host name.
- Creating a custom hostname and uploading a certificate and key pair for the private host. Click the Custom Hostname toggle, and then click Upload the Certificate to open a page to enter your certificate and key.
  Note
  You will need to upload the certificate and key for the custom host name. Click the Custom Hostname toggle, and then click Upload the Certificate to open a page to enter your certificate and key.
  The server cert should be on top, followed by the rest of the chain, with the root cert at the bottom.
  For more information about certificates, refer to Configuring Certificates for Private Apps Browser Access.
Enable Allow Unauthenticated CORS if you want to allow Cross Origin Resource Sharing (CORS) OPTIONS requests.

Refer to Enable CORS OPTIONS Request over Browser Access for more information.

Note

This feature is controlled by a feature flag. Contact Netskope Support to get this feature enabled.
Click in the Publisher text field and select one or more Publishers from the dropdown list.
Tip
For high-availability, add multiple Publishers for each Private App. By default, you can configure up to 16 Publishers for Browser Access per Private App.

The maximum number of Publishers configured for Browser Access can be increased to 64.
Contact Netskope Support or your sales representative to enable this feature.
Click Save.
A confirmation window opens for you to review the changes. After verifying the changes, click Confirm.

Connecting the Private App to the Publisher may take several minutes. Make sure that you see the green icon for this Private App before proceeding. If the badge is red, use the Troubleshooter feature or check your firewall rules before proceeding.

Note

When a user has access to a Private App on different tenants using Netskope-encoded Private App URLs from the same browser, then after accessing the Private App on one tenant, a user will need to clear the cookies from the browser before being able to access the Private App on a different tenant.

Create a Real-time Protection Policy for Browser Access to Private Apps

You need to create a Real-time Protection policy in order to allow Browser Access to Private Apps.

Go to Policies > Real-time Protection.
Click New policy and select Private App Segment Access.
For Source, select the Users, OU, or Groups for which you want to grant access to the private app(s).
You can also add an additional criteria Source IP. This enhances security by allowing administrators to restrict (allow or block) access to private applications based on the source (egress) IP of the end users.
Note that Source IP criteria for Browser Access is currently controlled by a feature flag. Please contact your Netskope account team to enable this feature.

Note

When this feature for Source IP Criteria is enabled for a tenant, the Source IP criteria become available within the policy for Private Apps. While the Source IP criteria will be visible for both Client and Browser Access in the UI, it will currently only apply to Browser Access based applications.
For Access Method, select Browser Access. At least one Access Method must be defined, either Browser Access or Client. If Browser Access is used, Client users will not be able to access Browser Access Private Apps.
It’s necessary to create two application definitions for each Private Access resource if you want to access a resource via both Browser Access and the Client.
If Access Method is not showing, click Add Criteria to search for and select Access Method, and then select Browser Access.
For Destination, leave Private App Segment and select your Private App Segment from the dropdown list.
For Action, select Allow to grant access. To deny access, select Block, select a policy notification template from the dropdown list, or create one.
Give the policy a name (like Browser Access for JIRA), and then click Email Notification to choose the notification template for the policy. When finished, click Save.
Click Apply Changes.