topic Re: SAML Azure AD - Remote access Access Role policy in SASE and Remote Access

SAML Azure AD - Remote access Access Role policy

Refaeliko — Thu, 04 Jan 2024 18:09:12 GMT

Hey,

I have a problem now on implementation when using SAML Azure AD authentication. Everything is working - authentication etc. Users can login properly - connectivity is ok.

The problem is that from the moment I added groups to the cp application in azure, even if there is no rule - the authorized users have access to all the networks. If they are restricted by a certain rule they still have access to all the networks, and the rule not working. Does anyone have an idea?

Thanks to those who answered!

Re: SAML Azure AD - Remote access Access Role policy

the_rock — Thu, 04 Jan 2024 20:43:41 GMT

Can you maybe send some screenshots of the rule in question, as well as groups referenced and the log showing that access? I think that would help us...please blur out any sensitive info.

Best,

Andy

Re: SAML Azure AD - Remote access Access Role policy

PhoneBoy — Thu, 04 Jan 2024 22:37:39 GMT

You've created the necessary groups in SmartConsole, correct?
https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/Topics-VPNRG/SAML-Support-for-Remote-Access-VPN.htm
You've added those groups to the relevant Access Role objects, correct?

Re: SAML Azure AD - Remote access Access Role policy

Refaeliko — Thu, 04 Jan 2024 22:51:06 GMT

Of course

Re: SAML Azure AD - Remote access Access Role policy

Refaeliko — Thu, 04 Jan 2024 23:04:57 GMT

This is exactly the point that the rule has no effect on the Azure users. Even if there is no rule on the azure users - all networks are open for these users. Even if there is a rule that blocks it, everything is still open. On the other hand, Legacy users work according to the rules. There was one case that stopped the access and it was that I created a rule that blocks 'all users' and then everything was blocked.

If the screenshots are still important to you - I will send them.