This article explains how to enable and test the Browser-based Access User Portal feature. This functionality enriches the end-user experience because users can view and access authorized private applications from a single portal.
Background
Currently, when a private app (not applicable for Enterprise Browser private apps) is published via Browser-based Access, you’ll configure either a custom hostname or access the app using a Netskope-encoded URL that gets generated in the tenant UI. An admin would need to share these links with end users for whom they need access, and this may become tedious for a large enterprise with hundreds or thousands of private applications. Admins can configure a user portal where logged-in users can obtain a list of Browser-based Access (only) applications they are authorized to access and launch from the portal.
Prerequisites
To configure a User Portal, you need a Netskope Reverse Proxy SAML Account for Private Apps already configured on your tenant.
Configure the User Portal
Ensure the feature flag for the NPA Browser Access User Portal feature is enabled for your Netskope tenant before proceeding.
- To configure a User Portal, go to Settings > Security Cloud Platform > App Definition, and on the Private App Segments tab, click New Application Segment.
- Select Browser and expand User Portal.
- Enable the Set up User Portal Configuration checkbox.
- Enter a Destination (Only FQDN is supported).
Note that Publisher(s), and App tags are not required because they are not applicable to the User Portal. The TLS termination of the user portal requests is handled by the NPA Browser Access Service.
Notes
- Configuring a custom hostname is best practice and should always be done; however, the portal can also be accessed directly using the Public Host URL.
- Only one portal per tenant can be configured.
- The portal configuration hostname can be a placeholder (dummy record) and doesn’t need to be a valid DNS A record. However, the intended portal FQDN must have a CNAME pointing to the public host URL generated in the configuration.
- Click Save.
Upload the Certificate Similar to custom FQDN certs, you will need to upload the cert for the portal following these instructions: Private App Cert UI.
User Portal Behavior with Enterprise Browser and Any Browser Apps
When Netskope Private Access (NPA) is used together with Netskope Enterprise Browser (EB), the Browser Access User Portal can act as a central entry point for:
-
Any Browser applications – private applications that can be accessed from standard web browsers.
-
Enterprise Browser applications – private applications that are only accessible from Netskope Enterprise Browser and do not expose a public host.
The user experience in the Portal depends on how users reach it and how the Portal application itself is defined.
Portal application types
The User Portal is itself an NPA browser application and can be defined in one of two ways:
-
Portal as an “Any Browser” application
-
Can be accessed from standard browsers using the Portal’s public or custom host.
-
Can also be accessed from Netskope Enterprise Browser.
-
Suitable when you have a mix of:
-
Internal users on Enterprise Browser, and
-
External or unmanaged users on standard browsers.
-
-
-
Portal as an “Enterprise Browser” application
-
Does not expose a public host.
-
Can only be accessed from Netskope Enterprise Browser using the Portal’s internal host.
-
Suitable for environments where only Enterprise Browser users need access to the Portal.
-
Only a single Portal application can be configured per tenant, so the chosen type should align with your overall access strategy (Enterprise Browser–only vs Enterprise Browser plus Any Browser users).
How Portal content varies by access method
The Portal dynamically adapts the tiles and links it presents based on how the user accesses it:
-
Portal accessed from a standard browser (Browser Access)
-
Users reach the Portal using its public or custom host.
-
The Portal displays tiles for Any Browser (Browser Access) applications that the user is authorized to access.
-
Each tile points to the public or custom host of the corresponding application.
-
-
Portal accessed from Netskope Enterprise Browser
-
Users reach the Portal using its internal host from within Enterprise Browser.
-
The Portal displays tiles for:
-
Any Browser (Browser Access) applications, and
-
Enterprise Browser–only applications,
that the user is authorized to access.
-
-
Each tile points to the internal host of the application, which is important for applications that use internal redirects or contain hard‑coded internal links.
-
This allows a single Portal definition to provide two distinct experiences:
-
A public‑style Portal for Any Browser users, using public or custom hosts.
-
An internal‑aware Portal for Enterprise Browser users, using internal hosts and including EB‑only applications.
Design considerations for mixed environments
When supporting both Enterprise Browser and standard browser access:
-
Decide whether the Portal should:
-
Serve all users (define it as an “Any Browser” application), or
-
Be restricted to Enterprise Browser users (define it as an “Enterprise Browser” application).
-
-
For environments serving both:
-
Standard browser users should be directed to the Portal’s public or custom host.
-
Enterprise Browser users should be directed to the Portal’s internal host to see both Any Browser and Enterprise Browser–only applications.
-
By clearly defining how different user groups reach the Portal, organizations can offer a consistent experience while taking advantage of deeper integration between Enterprise Browser and private applications.
Access Apps in the User Portal
After provisioning the portal app in the Netskope UI, an admin needs to share the portal URL with the end user(s). Only end-users specified in the policy are allowed to access the portal.
- Launch the User Portal and enter the IdP credentials. The landing page will look something like this.
- You can search for an app within portal, and also sort the apps. Click on the app tile to launch the app.
To log out, click the profile icon in the top right corner and select Log Out.
Troubleshooting the User Portal
Unable to reach the portal
- Ensure the portal is added in a real-time policy. If blocked due to lack of policy, an Alert would be generated in SkopeIT events.
Note that a successful login to the portal would be logged in SkopeIT Network Events. - Collect a HAR Capture and a screen recording for Support investigation.
- Ensure the portal hostname is resolvable.
- Customers would need to add the CNAME to their DNS to point the Portal hostname to the corresponding Web UI generated Public Host URL.
Note that Portal access will be supported with Netskope encoded URL as well.
~ $dig portal.acme.com ; <<>> DiG 9.10.6 <<>> portal.acme.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47812 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;portal.acme.com. IN A ;; ANSWER SECTION: portal.acme.com. 3600 IN CNAME ns-2abdedba-443-tenantname.goskope.com. ns-2abdedba-443-tenantname.goskope.com. 1800 IN A 163.116.158.137 ;; Query time: 312 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sat Aug 16 18:37:46 IST 2024 ;; MSG SIZE rcvd: 132
Certificate Validity
Check the validity of the certificate. Replace portal.acme.com with the actual portal URL.
openssl s_client -showcerts -servername portal.acme.com -connect portal.acme.com:443 | openssl x509 -noout -dates