topic Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89 in Firewall and Security Management

saml redirect from portal page broke after upgrading from JHF84 to JHF89

Daniel_Kavan — Tue, 05 Nov 2024 13:00:59 GMT

Hi All,

After upgrading from R81.20 JHF84 to JHF89 (in my lab) my redirect to my on prem IDP server broke. Although I can connect to it ok from the command line. If I revert back to JHF84 it works again. I'm not sure how to troubleshoot this, any ideas are welcome. We were actually planning on rolling it out this weekend. There were some changes in JHF89 for SAML. It looks like it tries to get to the idp server, fails and then fails to connect back to the portal. It happens so fast, it's like it isn't even trying. IOW, I'm not even getting to the inhouse IDP login page.

😞

This page isn’t working

portal.some.domain.com is currently unable to handle this request.

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

PhoneBoy — Tue, 05 Nov 2024 15:08:37 GMT

Wondering if one of these security enhancements is possibly causing issues with your IdP configuration.
There doesn't seem to be much in the way of troubleshooting information about SAML, though one suggestion in sk180543 is to install a SAML Tracer extension in your browser.
This will hopefully give you an idea of what's actually happening.

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

Daniel_Kavan — Tue, 05 Nov 2024 16:27:44 GMT

Thanks! It seems like it has nothing to do with SAML since I can't even get to the website, but I will try it. Looking at the httpd.log.0

PHP errors
[Tue Nov 05 11:18:16.713353 2024] [php7:notice] [pid 30702] [client ip:56661] [CAPTCHA] Captcha is not required
[Tue Nov 05 11:18:16.837429 2024] [php7:notice] [pid 14574] [client ip:56662] [absolute_portal_host] Receiving a NULL 'mab_portal_fqdn', referer: https://ip/Login/Login
[Tue Nov 05 11:18:17.100925 2024] [php7:notice] [pid 19567] [clientip:56666] [absolute_portal_host] Receiving a NULL 'mab_portal_fqdn', referer: IP/Login/Login
[Tue Nov 05 11:18:17.112959 2024] [php7:notice] [pid 19567] [client IP:56666] simplesamlphp ERR [TRb8098fb5] Configuration identity_provider definition., referer: https://IP/Login/Login
[Tue Nov 05 11:18:17.112991 2024] [php7:notice] [pid 19567] [client IP:56666] simplesamlphp ERR [TRb8098fb5] Configuration identity_provider definition., referer: https://IP/Login/Login
[Tue Nov 05 11:18:17.113005 2024] [php7:notice] [pid 19567] [client IP:56666] simplesamlphp ERR [TRb8098fb5] Configuration identity_provider definition., referer: https://IPurl/Login/Login

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

Daniel_Kavan — Tue, 05 Nov 2024 22:05:38 GMT

when it works (JHF84) the saml tracer shows a 302. A 302 status code is an HTTP response code that indicates a requested resource has been temporarily moved to a new location:, then it goes beyond the 302 to a 200, and it all works. When it doesn't work (JHF89) I'm getting a 500 internal server error, then that's it, nothing comes up. Is the internal error on checkpoint I assume not the in house IDP server. I can repeat the process over and over to JHF84 and back if anyone from R&D want to look at it.

Can R81.20 JHF89 manage an R82 gateway? Maybe, I'll try R82. But it doesn't look like it. https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RN/Content/Topics-RN/Supported-Security-Gateway-Versions.htm

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

the_rock — Tue, 05 Nov 2024 23:17:02 GMT

Definitely cant manage R82 gateway. You can try, but then you need R82 gw as well.

Andy

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

PhoneBoy — Wed, 06 Nov 2024 03:20:28 GMT

That's only possible across minor versions with a specific JHF level.
R82 is considered a major version.

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

JozkoMrkvicka — Wed, 06 Nov 2024 07:08:10 GMT

Can we expect in near future JHF for R81.10 and R81.20 that will support managing R82 gateways ?

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

PhoneBoy — Wed, 06 Nov 2024 14:59:35 GMT

No, I would not expect this as R81.x and R82 are different major releases.

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

Sören — Tue, 12 Nov 2024 09:05:44 GMT

@Daniel_Kavan Please check, if your metadata file from the IdP contains the option: "WantAuthnRequestsSigned="true". If yes, please change it to false and upload the metafile again.

SmartConsole:

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

Daniel_Kavan — Tue, 12 Nov 2024 20:09:23 GMT

Thanks Soren, that did it. I also updated to JHF90.

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

the_rock — Tue, 12 Nov 2024 20:24:05 GMT

Great tip, thanks @Sören

Andy

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

skandshus — Sun, 02 Nov 2025 14:30:52 GMT

Im seeing this error too.

Did you finally resolve it ?

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

skandshus — Sun, 02 Nov 2025 14:34:06 GMT

If i dont have the "wantauth" part in my XML file but seeing the same issue? what do i do then? and what has actually changed in the code since this start's to happen?

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

Daniel_Kavan — Mon, 03 Nov 2025 12:58:48 GMT

Hi, skandshus, What JHF are you on, R81.20 or R82? In any event, I didn't make any changes to my metadata file after upgrading to R82. Here's a snippet of my metadata. Try adding the code in there.

<md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

skandshus — Mon, 03 Nov 2025 13:04:52 GMT

i am using one of the new ARM Based firewall's which are based upon R82.10 so im unsure "where to bring my pain" because it doesnt seem like there's much info about this.

the SK i can find also refer's to a line <md:IDPSSODescriptor
i dont even have that in my XML file. i only have the IDPSSODescriptior. but i am missing the <md: part

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

Sören — Mon, 03 Nov 2025 13:13:36 GMT

You have to download the XML File from your IdP. What IdP are you using?

Example Keycloak - see step 6. LINK

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

skandshus — Mon, 03 Nov 2025 13:46:50 GMT

I am using Microsoft azure in the azure active directory
has been working fine for the last couple of years. now we upgraded firewall to the new ARM bases that ship's with R82.10 and then its now broken.

i've attached the one i got from Azure(rename the extension to xml 🙂

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

the_rock — Mon, 03 Nov 2025 13:47:45 GMT

Thanks for that @skandshus !

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

skandshus — Mon, 03 Nov 2025 13:50:56 GMT

Thank's for what? 😄

Re: saml redirect from portal page broke after upgrading from JHF84 to JHF89

the_rock — Mon, 03 Nov 2025 13:51:50 GMT

For the file 🙂