topic Remote access community participating group using Azure saml authentication in General Topics

Remote access community participating group using Azure saml authentication

Gaurav_Pandya — Tue, 11 Jun 2024 17:08:52 GMT

Hi Mates,

I have configured Azure saml authentication for remote access vpn. During testing, We are getting "Negotiation with site is failed" error message on client side and "user does not belong to remote access community" in smart console.

When I changed remote access vpn community participating group to "all user", we are able to authenticate for remote vpn using saml.

Question here is, can I map Azure identity provider group in remote access community participating group? because it does not show any identity provider group when I try to add in participating group. Or I need to keep "All user" in participating group?

Re: Remote access community participating group using Azure saml authentication

PhoneBoy — Tue, 11 Jun 2024 18:43:20 GMT

Create groups as described here: https://support.checkpoint.com/results/sk/sk177267

Re: Remote access community participating group using Azure saml authentication

the_rock — Tue, 11 Jun 2024 19:11:49 GMT

The sk Phoneboy gave you is definitely good place to start. One of my colleagues and I had to do this for a large customer.

Re: Remote access community participating group using Azure saml authentication

the_rock — Tue, 11 Jun 2024 19:26:15 GMT

I attached a doc that hopefully is helpful to you.

Andy

Re: Remote access community participating group using Azure saml authentication

Gaurav_Pandya — Wed, 12 Jun 2024 08:20:13 GMT

Thanks, Phoneboy. I have already created and tested with group name EXT_ID_ with no luck. I will verify configuration with Azure administrator.

Re: Remote access community participating group using Azure saml authentication

Gaurav_Pandya — Wed, 12 Jun 2024 08:20:56 GMT

Thanks @the_rock for sharing document. I will verify.

Re: Remote access community participating group using Azure saml authentication

the_rock — Wed, 12 Jun 2024 11:10:39 GMT

Hope it really helps you, as we always follow it and works fine. Let me know if any issues.

Re: Remote access community participating group using Azure saml authentication

Gaurav_Pandya — Mon, 17 Jun 2024 10:39:57 GMT

We have followed sk177267 & sk172909 to define group in Azure. Still, it was not working, Lastly, we have configured each group has its own role which you mentioned in supplementary instruction document (Undocumented step – CRUCIAL). It did the trick. Now it is working as expected.

Thanks again for sharing supplementary instruction document.

Re: Remote access community participating group using Azure saml authentication

the_rock — Mon, 17 Jun 2024 10:42:58 GMT

I agree, thats super important step. My colleague and I got that from Azure documentation, I will write a feedback about it in the sk.

Best,

Andy

Re: Remote access community participating group using Azure saml authentication

the_rock — Mon, 17 Jun 2024 11:56:59 GMT

Okay, just submitted a feedback.

Andy