topic Re: Configure the SAML application on the Identity Provider's website. - AZURE in SASE and Remote Access

Configure the SAML application on the Identity Provider's website. - AZURE

nflnetwork29 — Fri, 12 May 2023 14:37:04 GMT

I noticed there is Checkpoint apps in the Azure AD Gallery.

Can these be used when setting up the SAML application on the Identity Provider's website. The documentation is not clear .

Or do we need to create new (non-gallery) apps?

Re: Configure the SAML application on the Identity Provider's website. - AZURE

PhoneBoy — Sat, 13 May 2023 02:22:24 GMT

@Liel_Shaish

Re: Configure the SAML application on the Identity Provider's website. - AZURE

nflnetwork29 — Sat, 13 May 2023 14:05:18 GMT

found this video where two different azure apps are being used.

step 1 - create a non-gallery app to be used for the azure integration with smart console.

step 2 - use checkpoint gallery app to be used for SAML based-sign on with the VPN.

https://www.youtube.com/watch?v=yZVB3sJ3fZ8

*** that being said my vpn rule where i have specified an access role that links to an azure group is not being matched correctly. all my vpn traffic is hitting the cleanup rule.

Re: Configure the SAML application on the Identity Provider's website. - AZURE

PhoneBoy — Mon, 15 May 2023 17:01:02 GMT

Have you performed the steps here? https://support.checkpoint.com/results/sk/sk177267

Re: Configure the SAML application on the Identity Provider's website. - AZURE

nflnetwork29 — Wed, 17 May 2023 18:47:56 GMT

yes, and also here.

https://support.checkpoint.com/results/sk/sk179788

guessing you suggest open new ticket with TAC?

Re: Configure the SAML application on the Identity Provider's website. - AZURE

Alex- — Wed, 17 May 2023 18:55:47 GMT

Check this thread.

Solved: Access Role not working? - Check Point CheckMates

Re: Configure the SAML application on the Identity Provider's website. - AZURE

nflnetwork29 — Wed, 17 May 2023 19:37:14 GMT

Bingo! Thank you @Alex-

I knew this document existed but i could not locate for the life of me!!!!!

@PhoneBoy Why is this not being documented in an SK by check point?

Re: Configure the SAML application on the Identity Provider's website. - AZURE

PhoneBoy — Wed, 17 May 2023 21:26:28 GMT

Our documentation is generic and does not cover the exact steps needed in a given IdP.
These missing instructions belong in an IdP integration guide, which would definitely be useful to have.

Re: Configure the SAML application on the Identity Provider's website. - AZURE

nflnetwork29 — Wed, 17 May 2023 22:03:13 GMT

i would think the IdP is Azure in 99% of the cases. i could be wrong.