topic Identity Provider Reply URL section is blank in Firewall and Security Management

Identity Provider Reply URL section is blank

erkansimsek — Thu, 01 Jun 2023 14:45:35 GMT

Hello,

I need to SAML configuration for admin accounts but Reply URL link section is empty, how can I solve this ?

I use R81.20 on mgmt and attahced the screenshot.

Thanks a lot.

Re: Identity Provider Reply URL section is blank

PhoneBoy — Mon, 05 Jun 2023 17:55:07 GMT

What precisely are you using as management here?
If it's Smart-1 Cloud, then I believe you configure access via Infinity Portal.
You can confirm this via the TAC: https://help.checkpoint.com

Re: Identity Provider Reply URL section is blank

the_rock — Mon, 05 Jun 2023 17:56:54 GMT

I had this working before and that field was always empty. As a matter of fact, TAC person told me that was normal.

Andy

Re: Identity Provider Reply URL section is blank

PhoneBoy — Mon, 05 Jun 2023 18:10:39 GMT

I tried to configure this in Demo Mode a bit ago and it put something in the Reply URL.
Possible it is meant to be blank with Smart-1 Cloud, not sure.

Re: Identity Provider Reply URL section is blank

the_rock — Mon, 05 Jun 2023 18:16:34 GMT

Yea, just tried it in R81.20 lab and below is what I see.

Andy

Re: Identity Provider Reply URL section is blank

madu1 — Tue, 25 Feb 2025 17:50:51 GMT

On a kind of related note, I'm trying to set up SAML for SmartConsole login (all on-prem, not cloud). When I create the Identity Provider, the Reply URL gives the 10.x.x.x IP of the SmartCenter. Is this normal?

To be fair I haven't tested yet, but the person setting up the Azure side refused to take the URL and said it has to be a public IP otherwise it will never reply back to the firewall. I've tried changing the Platform Portal IP, and the SmartCenter has a static NAT assigned, but I can't get it to populate the Reply URL with the NAT IP. Does anyone know how to change this? Or will it work if I insist the Azure person just uses the URL with 10.x.x.x in?

Re: Identity Provider Reply URL section is blank

PhoneBoy — Wed, 26 Feb 2025 18:06:09 GMT

As I understand it, the Reply URL is sent to the browser AFTER the user is authenticated with the IdP to communicate the SAML Assertion to the SP (in this case, the management server).
Therefore, the Reply URL can include an internal IP.