topic Identity agent no SSO after hardening in Firewall and Security Management

Identity agent no SSO after hardening

Tom_Heesmans — Tue, 01 Jun 2021 07:49:41 GMT

Hi all,

Since we have hardened our Windows 10 systems we noticed that the identity agent is no longer automatically logging in.

First we thought this had something to do with the network discovery so we've configured the server (gateway) manually within the agent. However no change.

I'm looking for information on the "inner workings" of the agent to find out why the user is not able to SSO directly. We have tested on laptop system with cached credentials still enabled but the same issue occurs.

Re: Identity agent no SSO after hardening

PhoneBoy — Tue, 01 Jun 2021 13:43:57 GMT

What precise steps did you take to harden Windows 10?
Tagging @Royi_Priov also.

Re: Identity agent no SSO after hardening

Tom_Heesmans — Tue, 01 Jun 2021 14:44:33 GMT

We did a lot, <correction> we applied CIS level 1.

Re: Identity agent no SSO after hardening

Tobias_Moritz — Thu, 03 Jun 2021 14:51:53 GMT

I suggest checking this thread:
https://community.checkpoint.com/t5/Management/When-will-AES-256-AES-128-Kerberos-cipher-suites-finally-be/td-p/2941

I guess your hardening disabled some legacy ciphers for Kerberos on your clients, so you have to adjust Identity Awareness config to use modern ciphers your client still supports.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/IDAG/pdp-auth.htm