topic Re: Check Point VPN Remote Access + Azure AD – LDAP Groups Not Assigned in Endpoint

Check Point VPN Remote Access + Azure AD – LDAP Groups Not Assigned

Gacki — Mon, 24 Mar 2025 10:09:24 GMT

Hi all,

I'm running into an issue with Check Point Remote Access VPN authentication via Azure AD (SAML). Users can successfully authenticate and establish a VPN session, but they are always assigned to the default "All Users" group. The LDAP groups from Active Directory are not being applied, even though the users are members of the appropriate AD groups (e.g., VPN_Users_AD).

Remote Access VPN is working with Azure AD / SAML authentication
On the Check Point Gateway:
- Identity Awareness is enabled
- Identity Collector is installed and shows connected (DCs, users, etc.)
- LDAP Account Unit is configured and working (can browse AD users/groups)
Identity Sources include Remote Access and Identity Collector
What else can I check to ensure that LDAP group membership from AD is correctly assigned to users logging in via Remote Access VPN (Azure AD)?
Is there a known limitation with SAML-based logins and LDAP group resolution?
Thanks in advance for any insights or suggestions!

Re: Check Point VPN Remote Access + Azure AD – LDAP Groups Not Assigned

delToro1 — Mon, 24 Mar 2025 10:49:27 GMT

Hello! Did you create the specific App role in Azure? After that, you have to create a local group following the EXT_ID_<role_name>

Re: Check Point VPN Remote Access + Azure AD – LDAP Groups Not Assigned

Gacki — Mon, 24 Mar 2025 11:00:06 GMT

In the Remote Access VPN configuration, I see user groups like:

EXT_ID_Administradores_VPN_CheckPoint
EXT_ID_VPN_CheckPoint

These are listed under Participant User Groups (see screenshot).

Are these groups directly mapped to Azure Entra ID (Azure AD) groups?
Or are they just internal Check Point objects that need to be manually linked to LDAP or SAML attributes?

Trying to understand if these are automatically synced from Azure, or if I need to create and manage the mapping myself.

Re: Check Point VPN Remote Access + Azure AD – LDAP Groups Not Assigned

delToro1 — Mon, 24 Mar 2025 11:11:35 GMT

These are local groups, that are mapped with de EntraID groups. See the step 6 in the documetation:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/SAML-Support-for-Remote-Access-VPN.htm?Highlight=SAML#

On the other hand, you have to configure the SAML attribute "group_attr" for the mapping