topic VPN Remote Access - MFA with SAML and Google Cloud as Identity Provider in SASE and Remote Access

VPN Remote Access - MFA with SAML and Google Cloud as Identity Provider

j_silva — Wed, 08 Jan 2025 11:45:41 GMT

Good morning everyone,

I am helping to implement two-factor authentication between Check Point and Google using SAML for Remote Access VPN connections. The Identity Provider settings are configured correctly and the client can successfully connect to the VPN. However, I cannot see the groups that the user belongs to and therefore I cannot create rules based on user groups. I followed this documentation -> https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/SAML-Support-for-Remote-Access-VPN.htm (Step 6: Configure the Group Authorization), however, I cannot handle access by groups.
Do any of you have any experience with this type of implementation that you could share?

Re: VPN Remote Access - MFA with SAML and Google Cloud as Identity Provider

AkosBakos — Wed, 08 Jan 2025 12:11:10 GMT

Hi,

If I understood correcly, you have to create manually with EXT_ID_ prefix.

if your grp attribute is "akos", then you need to create an user group with EXT_ID_akos name:

In SmartConsole, create an internal User Group object with this name (case-sensitive, spaces not supported):

EXT_ID_<Name_of_Role>

For example, for a role in the Identity Provider's interface with the name my_group, create an internal User Group object in SmartConsole with the name EXT_ID_my_group.

Note - In Microsoft Azure, Identity Tags are not supported for Remote Access connections.

I hope it helps

Akos

Re: VPN Remote Access - MFA with SAML and Google Cloud as Identity Provider

j_silva — Wed, 08 Jan 2025 12:16:00 GMT

Thank you very much,

Can you tell me where I can correctly configure the groups parameter in Google Cloud?

I have already tried to do this configuration. I will validate it again and report the results.

Re: VPN Remote Access - MFA with SAML and Google Cloud as Identity Provider

AkosBakos — Wed, 08 Jan 2025 12:22:44 GMT

Hi,

I am not familiar with Google Cloud, maybe the Legends will help 🙂

Have you asked the ChatGPT already?

Ákos

Re: VPN Remote Access - MFA with SAML and Google Cloud as Identity Provider

PhoneBoy — Thu, 09 Jan 2025 02:46:11 GMT

The relevant groups must be passed as part of the SAML assertion.
In Google Cloud, it looks like you configure this here: https://cloud.google.com/iap/docs/saml-attribute-propagation

Re: VPN Remote Access - MFA with SAML and Google Cloud as Identity Provider

j_silva — Fri, 10 Jan 2025 12:25:04 GMT

Hi @AkosBakos

I have tried to find out this information on ChatGPT but it wasn´t clear for me. Yesterday i had a meeting with TAC e some debugs was collected.

I´ll waiting for the results of analysis and i update this chat as soon as possible.

Thank you.

Re: VPN Remote Access - MFA with SAML and Google Cloud as Identity Provider

j_silva — Fri, 10 Jan 2025 12:26:24 GMT

Hi @PhoneBoy

Thanks for documentation. I´ll forward to the customer because i don´t have access on Google plataform.