topic Re: SAML Azure AD - Remote access Access Role policy in SASE and Remote Access

SAML Azure AD - Remote access Access Role policy

support_suppor1 — Tue, 01 Mar 2022 13:31:30 GMT

Hi,

We are having a problem now on implementation when using SAML Azure AD authentication. Everything is working - authentication etc. Users can login properly - connectivity is ok.

My problem is that when we use the access role and choose a specific user / group - the access role is not working and traffic goes thru Clean up rule. Access role works when it is set to "Any Authenticated" but this would not be helpful when there are multiple user with different access. Any help is appreciated - is there a special config or is this a limitation. We are running R81 + JHF 56 (latest)

Thanks

Re: SAML Azure AD - Remote access Access Role policy

PhoneBoy — Thu, 03 Mar 2022 23:42:10 GMT

Are you sure the application in Azure AD is set up per here?
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_IdentityAwareness_AdminGuide/Topics-IDAG/Using-Azure-AD-for-Authorization.htm?Highlight=graph
The groups needed for Azure AD are retrieved via the Graph API (supported in R81 and above).

Re: SAML Azure AD - Remote access Access Role policy

Zoran_Filipac — Fri, 01 Apr 2022 14:11:18 GMT

Had the same issue on R81, login to Azure SAML worked fine but after that , cleanup rule was used instead of the specific access role policy rule. TAC provided a hotfix and this started working after we applied the hotfix to the gateway and installed the policy. Hotfix will be custom and dependent on your HFA level.

Re: SAML Azure AD - Remote access Access Role policy

lrossi89 — Mon, 30 May 2022 09:11:38 GMT

i have the same issue on r81.10 take 45 , Is there a public SK on this?

Re: SAML Azure AD - Remote access Access Role policy

lrossi89 — Mon, 30 May 2022 14:02:54 GMT

can you share the SR# number ?

Re: SAML Azure AD - Remote access Access Role policy

Gaurav_Pandya — Fri, 11 Nov 2022 09:44:08 GMT

We had same issue. After SAML authentication (Azure AD), Users were not able to access LAN networks. Access role was not matched. We followed below steps to resolve issue.

Now I have different problem. I cannot use mobile access application with Azure IDP access role as per sk171557. I am checking if I need to use simple "destination" field to restrict user for specific destination or not.

Re: SAML Azure AD - Remote access Access Role policy

lrossi89 — Fri, 11 Nov 2022 10:42:46 GMT

Check this : sk179788 Access Roles are not enforced when using SAML authentication

Re: SAML Azure AD - Remote access Access Role policy

Gaurav_Pandya — Mon, 14 Nov 2022 08:02:35 GMT

Hi,

Access role issue is already resolved but my concern is how I can use Access role Azure identity with mobile access application to restrict user for certain destination.

As per sk171557, we cannot do that

Re: SAML Azure AD - Remote access Access Role policy

lrossi89 — Tue, 10 Jan 2023 10:05:55 GMT

Through this SK179788 it works, but we are finding an anomaly:

- We are using Azure AD groups directly, and it seems to work correctly.

step -> Using Azure AD for Authorization https://sc1.checkpoint.com/documents/r81/webadminguides/en/cp_r81_centityAWareness_adminguide/topics-idag/using-azure-for-uthorization.htm?highlight=graph

- But in a random way sometimes the firewall "not retrieve the correct group from AD Azure" and makes the retrieval from the LOCAL LDAP groups (from local Active Directory), and in this case VPN connections doesn't work because non match the correct AR Azure.

Then just after an install policy everything recovers and the firewall retrieve the correct information from azure

Has anyone made this integration, without setting manual groups and works without anomalies?

Re: SAML Azure AD - Remote access Access Role policy

PhoneBoy — Tue, 10 Jan 2023 13:45:03 GMT

Sounds like a bug and I recommend opening a TAC case.

Re: SAML Azure AD - Remote access Access Role policy

nflnetwork29 — Sat, 13 May 2023 01:10:57 GMT

Step 1 - d
Click New Application > Non-gallery application.

Can we use the pre populated Checkpoint Secure VPN access application or is the specific requirement to create a new non-gallery application? what is the reason.