topic Re: Is SAML support available in r80.10? in General Topics

Is SAML support available in r80.10?

Vladimir — Sat, 11 Nov 2017 23:58:22 GMT

Hi.

I was reading the sk98811 and tried to lookup same feature in r80.10, but no luck.

Any ideas where to look for it will be appreciated.

Re: Is SAML support available in r80.10?

PhoneBoy — Sun, 12 Nov 2017 01:31:22 GMT

It is not currently supported in R80.x.

Re: Is SAML support available in r80.10?

Mahipal_Singh — Mon, 29 Jan 2018 08:13:59 GMT

any roadmap?

Also if customer have AD server in Azure and using ADFS, can we have an integration ready with Azure ADFS?

Re: Is SAML support available in r80.10?

PhoneBoy — Mon, 29 Jan 2018 15:28:51 GMT

I believe there is roadmap for both items, but no dates to share at this time.

Re: Is SAML support available in r80.10?

Michael_Massa — Mon, 25 Mar 2019 16:12:19 GMT

Is there roadmap info for SAML in R80.20/.30?

Re: Is SAML support available in r80.10?

PhoneBoy — Mon, 25 Mar 2019 18:20:33 GMT

It will most likely be a future version.

Re: Is SAML support available in r80.10?

Heath_H — Wed, 13 May 2020 22:10:25 GMT

Two years after this question was first asked, and still nothing formal on Roadmap or expected version of code? It's not in R80.30 or R80.40.

The challenge is that while RADIUS works, it precludes customers for using any U2F/FIDO2 style MFA tokens, which are more secure than traditional OTP based tokens. The only secure option for customers at present is an MFA solution that supports Push notification, but that requires a smart phone with the app and available mobile phone data service. There are situations where phones are not allowed (manufacturing floors, for example) or where you don't have mobile coverage but would still have Internet (wired, dial-up, etc.). Additionally, there are situations where a user might not have a mobile phone or only have a personal one that doesn't support the necessary mobile app and you need to deploy a hardware token to the user or use a hardware token as a backup to the mobile app.

Re: Is SAML support available in r80.10?

PhoneBoy — Wed, 13 May 2020 22:16:08 GMT

There is SAML support in R80.40 for Identity Awareness specifically.
See: https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/Identity-Awareness-using-Azure-AD/m-p/84940/highlight/true#M6555
This has not made its way into the Remote Access clients yet.

Re: Is SAML support available in r80.10?

Heath_H — Thu, 14 May 2020 12:53:07 GMT

While interesting, the remote access client is where it's really valuable. It's ultimately a matter of priorities, I guess. Other vendors have had SAML support in their clients for years.

To me, being unable to support U2F as an MFA token is a big miss for a company that prides itself on being on the leading edge of security.

It pains me to say it, but Check Point has really paid little attention to remote access security for the past 4-5 years. Even the Mobile Access SSL-VPN is very long in the tooth. Hotfix after hotfix just to be able to use it on modern systems and browsers. And not even included in the JHF, but as special MABDA hotfixes that required a reboot of a firewall to install. Finally showing up in R80.40.

It's just my personal opinion, but it feels like Check Point is just chasing butterflies and not paying enough attention to the fundamentals.

Re: Is SAML support available in r80.10?

PhoneBoy — Thu, 14 May 2020 16:48:41 GMT

Adding SAML support to the VPN clients is not in the near-term plans.
I would encourage you to discuss the requirements with your local Check Point office, which can help promote this.

Re: Is SAML support available in r80.10?

Paulo_Rosa — Wed, 15 Jul 2020 15:28:24 GMT

I think is important for suport of new solutions like OKTA, DUO etc.

Cisco , Fortinet & Palo Alto already have this feature available.

Re: Is SAML support available in r80.10?

PhoneBoy — Wed, 15 Jul 2020 15:37:34 GMT

Believe this is now planned for R81.
Encourage you to get involved with the EA.

Re: Is SAML support available in r80.10?

Heath_H — Wed, 15 Jul 2020 15:43:43 GMT

I'll certainly check out the EA, but we are still working through the planning for the R80.40 upgrade. Is there an overall timeline for when R81 will go GA? I assume that SAML support in the client will likely not make the first few GA releases given the late inclusion of it in the plan.

What is the best path to get confirmation on the roadmap and timing for this feature in R81? Through my account team?

Re: Is SAML support available in r80.10?

PhoneBoy — Wed, 15 Jul 2020 16:23:50 GMT

Plan is end of September, however the more EA participants we get, the faster it can release.
More details about R81 EA here: https://community.checkpoint.com/t5/Product-Announcements/R81-EA-Program-Production/ba-p/86945
If you need a formal commitment for a particular feature, your best bet is your local account team.

Re: Is SAML support available in r80.10?

AntoF — Thu, 25 Feb 2021 07:05:00 GMT

I have read in R81 Identity Awareness admin guide that SAML is supported on R81 using Captive Portal. Is this feature also available for the Endpoint Security vpn clients?

Re: Is SAML support available in r80.10?

PhoneBoy — Thu, 25 Feb 2021 07:13:19 GMT

It’s planned for the near future but it will first come to the R80.40 JHF and later the R81 JHF.
If you need it now, we have a customer release available thru your local Check Point office.

Re: Is SAML support available in r80.10?

SasaSamardzic — Wed, 24 Mar 2021 08:01:47 GMT

Hello PhoneBoy,

do you have any news regarding this?

Kind Regards

Sasa

Re: Is SAML support available in r80.10?

PhoneBoy — Wed, 24 Mar 2021 17:36:02 GMT

The status of this is unchanged.
I highly recommend engaging with your local Check Point office around this requirement.