Check Point VPN Remote Access + Azure AD – LDAP Groups Not Assigned

[Gacki]

Hi all,

I'm running into an issue with Check Point Remote Access VPN authentication via Azure AD (SAML). Users can successfully authenticate and establish a VPN session, but they are always assigned to the default "All Users" group. The LDAP groups from Active Directory are not being applied, even though the users are members of the appropriate AD groups (e.g., VPN_Users_AD).

• Remote Access VPN is working with Azure AD / SAML authentication

• On the Check Point Gateway:

  • Identity Awareness is enabled

  • Identity Collector is installed and shows connected (DCs, users, etc.)

  • LDAP Account Unit is configured and working (can browse AD users/groups)

• Identity Sources include Remote Access and Identity Collector

  What else can I check to ensure that LDAP group membership from AD is correctly assigned to users logging in via Remote Access VPN (Azure AD)?

  Is there a known limitation with SAML-based logins and LDAP group resolution?

  Thanks in advance for any insights or suggestions!

[delToro1]

Hello! Did you create the specific App role in Azure? After that, you have to create a local group following the EXT_ID_<role_name>

BR

[Gacki]

In the Remote Access VPN configuration, I see user groups like:

• EXT_ID_Administradores_VPN_CheckPoint

• EXT_ID_VPN_CheckPoint

These are listed under Participant User Groups (see screenshot).

Are these groups directly mapped to Azure Entra ID (Azure AD) groups?
Or are they just internal Check Point objects that need to be manually linked to LDAP or SAML attributes?

Trying to understand if these are automatically synced from Azure, or if I need to create and manage the mapping myself.

[delToro1]

These are local groups, that are mapped with de EntraID groups. See the step 6 in the documetation:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

 

On the other hand, you have to configure the SAML attribute "group_attr" for the mapping

 BR