topic Re: OKTA AS IDP FOR CHECK POINT VPN CLIENT in General Topics

OKTA AS IDP FOR CHECK POINT VPN CLIENT

tarsonflorencio — Tue, 14 May 2024 18:41:03 GMT

Hello everyone, good afternoon, how are y'all?

We have successfully integrated OKTA as an identity provider via SAML 2.0 for authentication of Check Point VPN through the browser (SSL Bookmark), which works perfectly. However, when attempting authentication through the VPN Mobile Client, we encountered an error immediately after passing the authentication by OKTA: “Access denied. The destination of your request has not been configured, or you do not have authorization to access it” (403), as illustrated in the image below.

I suspect the problem is related to authorization configurations in the VPN, as we have tried several other configurations without success. The External User Profile object is set up as Generic and the authentication scheme is set to IDP.

Could you help us resolve this situation? I believe your assistance and detailed analysis could be decisive.

Re: OKTA AS IDP FOR CHECK POINT VPN CLIENT

PhoneBoy — Tue, 14 May 2024 22:12:07 GMT

What version/JHF are the gateway and management?
Please make sure you meet all the requirements here: https://support.checkpoint.com/results/sk/sk172909

Re: OKTA AS IDP FOR CHECK POINT VPN CLIENT

the_rock — Wed, 15 May 2024 02:05:02 GMT

To me at least, logically, that error does not indicate OKTA issue, but rather access policy for mobile access...something there is missing or not allowed, seems like.

Andy

Re: OKTA AS IDP FOR CHECK POINT VPN CLIENT

tarsonflorencio — Fri, 17 May 2024 13:32:18 GMT

Hey Buddy, The version is R81.20 Jumbo Hotfix Take 41.
Thank you so much, I'll take a look at this link.

Re: OKTA AS IDP FOR CHECK POINT VPN CLIENT

tarsonflorencio — Fri, 17 May 2024 13:36:49 GMT

Nice clue man, I'll check on the access policy for mobile access.
Appreciate

Re: OKTA AS IDP FOR CHECK POINT VPN CLIENT

the_rock — Sat, 18 May 2024 01:27:35 GMT

Sounds good.