Clientless VPN URL

[SriNarasimha005]

Hi Team

I am currently engaged in the Clientless/Mobile access VPN project, which necessitates a single URL: https://clientless.mydomain.com/sslvpn. This URL is intended to direct traffic to various nodes based on the geographic locations from which users are accessing the service (for example: node1.clientless.mydomain.com/sslvpn, node2.clientless.mydomain.com/sslvpn, etc.).

Users will be authenticated through OKTA and depending on the AD groups, users will access the applications assigned to them. However, when I attempt to implement this via GTM, it successfully redirects me to a node as anticipated, but when I click the IDP link, there is no response, and the CP fails to redirect to the IDP for authentication.

I encounter an error in the browser stating, 'The target origin (https://node1.clientless.mydomain.com/sslvpn) does not match the recipient window's origin https://clientless.mydomain.com/sslvpn.'

Any suggestions how to get the resilience accomplished for the URL?

[SriNarasimha005]

Hi @Shay_Levin @PhoneBoy 

Can you please share your feedback on this? I'm unable to find any documentation relating to deploying clientless VPN behind a Load balancer/GTM with SAML (Okta) integration.

Would like to seek your help please 😊

[PhoneBoy]

As part of SAML authentication, host/cluster specific URLs are likely being used.
As a result, when the load balancer domain is seen instead of the expected domain, the authentication fails.

You might be able to adjust the URLs used for the IdP (specifically the response from the IdP), but not exactly sure how to do that.