topic Re: ADFS remotes access VPN with SAML in SASE and Remote Access

ADFS remotes access VPN with SAML

Christian_Koehl — Tue, 04 Feb 2025 16:12:53 GMT

Dear Checkmates,

I have running an Management with R81.20 + JHF-89 and a firewall modul also with R81.20 + JHF-84.

For remote access VPN SAML authentication shoud be used. I followed: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/SAML-Support-for-Remote-Access-VPN.htm?tocpath=_____19

The user get an popup from the browser is asking for username and password and then presenting the PIN, which needs to be entered in the MS Authenticatior.
Unfortunately, then the login fails.

Any idea's?

Best regards,
Christian

Re: ADFS remotes access VPN with SAML

Nüüül — Wed, 05 Feb 2025 07:32:54 GMT

Can you tell a bit more on your configuration?

how did you configure the group authorization part? SAML Attribute? LDAP Account Unit?

Re: ADFS remotes access VPN with SAML

Christian_Koehl — Fri, 07 Feb 2025 11:00:31 GMT

Hi,
sorry for not answeing earlier.
The main problem was, the response from the ADFS proxy was a http "redirect". Now, it is a "post". We are in principle able now, to authentificate successfully.

One left topic it, it seems as the ADFS group "abc123" and the local usergroup "EXT_ID_abc123" didn't match.
We use the "EXT_IT_abc123" group in the RemoteAccess Community object, but this group didn't match here, only an older ldap-group matches.

BR,

Christian

Re: ADFS remotes access VPN with SAML

Nüüül — Sat, 08 Feb 2025 06:58:11 GMT

Hi Christian,

i assume group names EXT_ID vs. EXT_IT is a typo, right? you might have a look at the user directories config now. like

Otherwise the gateways will try to fetch AD groups for a user.

if this doesn´t work, we can have a look at it on monday - send me a private message

cheers

daniel

Re: ADFS remotes access VPN with SAML

Christian_Koehl — Tue, 04 Mar 2025 13:03:18 GMT

Dear Daniel,

Sorry for not answering...

Yes, it is a typo.

The customer managed it and it works now. It was a setting on the ADFS site.

Thanks alot...