Smart-1 Cloud SAML VPN do_ldap_fetch and do_internal_fetch

[Duane_Toler]

Hey all,

For customers with Smart-1 Cloud, are we somehow able to use GUIDBedit to modify internal parameters like the ones for SAML VPN?  AFAIK, GUIDBedit won't use the Infinity Portal token login like SmartConsole.

Does anyone know what would be the right way to set parameters like do_ldap_fetch and do_internal_fetch for SAML?

Thanks!

[the_rock]

You can use guidbedit, I will send the video later 🙂

Andy

[Duane_Toler]

Oh geez.. 🤦🏻‍♂️

I feel like a dork. 😂

[the_rock]

Sorry I did not take video, because of customer's info, but screenshots helped, glad to hear.

Do NOT feel like a dork, happens man, we are here to help one another and yes, you can change that value you mentioned, but depends on your identity provider.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RemoteAccessVPN_AdminGuide/Topics-...

Andy

[the_rock]

Btw, here is what it says online..

To correctly set do_ldap_fetch and do_internal_fetch parameters for SAML, you should set do_generic_fetch to false if using an on-premises LDAP directory to use the SAML identity provider for fetching user attributes, and set do_internal_fetch to false if you are not using an on-premises LDAP and instead rely solely on the identity provider. The key is to disable the general fetch or the internal fetch to ensure the SAML information is the primary source for user data. 

[Duane_Toler]

Yep!  I’ll be configuring this with a customer that doesn’t have a Windows AD nor internal LDAP server for any user directory info. They only have Entra ID and O365 user accounts. I plan to use identity agent on their PCs and locally defined groups and access roles.

VPN users will use SAML for Azure MFA.

It’s going to be quite an interesting configuration! Might even end up with some Identity API scripts on some internal-only Linux hosts.  😆

[the_rock]

O yea, go for it!