Hi,
Apologies in advance for the rather long post, but I’m looking at configuring our R81.10 gateways (JHF 130) to use SAML authentication for remote access VPN (Entra as the identity provider), and I'm a bit uncertain about some of the implications of switching from our current authentication method (on premises Active Directory via radius). I've found some good documentation covering the configuration process (e.g. sk172909, the remote access VPN administration guide, the supplementary instructions here, and Microsoft's own documentation), but I was wondering whether there's a way of rolling out the change gradually, for example by allowing a subset of users to authenticate via SAML while the majority continue to authenticate as usual via radius?
This thread suggests it isn't possible to configure different authentication methods based on LDAP groups, but this one suggests that it might be possible using different LDAP account units. Is the idea to add multiple login options under General Properties > VPN Client > Authentication, to configure each option to use a different authentication method and user directory, to configure those user directories to use a different AU, and then to have each AU scoped to look at a different branch of the user directory (in our case, an OU within Active Directory)?
Assuming each login option is configured to use a single authentication method and a different group of users, what would users see when they try to connect? The documentation for multiple login options mentions that "users select one of the available options", but I wasn't sure how that would work in practice if separate groups of users only have access to a single authentication method. Would users only be presented with the methods that apply to them, or will all users see a list of all configured options, some of which they won't be able to use?
If the only option is to switch the authentication method for everyone at the same time, I was wondering how easy it would be to back out of that configuration if there are any problems? Can we just change authentication back to using radius, or do we need to unpick some of the other changes as well? For example, would we need to revert the changes made using GuiDBEdit, or unset the generic API objects added by the configuration script (allow_VPN_RA_for_R8040_and_above_gateways_V2.sh)? Would the changes made using GuiDBEdit or the config script be incompatible with switching VPN authentication back to radius, or could we just leave those changes in place? Is there any more documentation about what the changes made using GuiDBEdit or the generic API objects are actually doing?
Another possible complication is that we use machine authentication to control which resources VPN users can access depending on whether they're connecting from a personal machine or an institutionally owned one (business owned machines are identified using AD auto-enrolment certificates, and Machine Certificate Authentication > Send Machine Certificate is set to "When Available"). Would this still be possible If we switched over to SAML? Would the machine auth be handled completely separately from the SAML based user authentication, so that the VPN client passes back the SAML token and the machine cert independently of each other?
Related to that, would users still be able to authenticate from personal machines that don't exist in Entra? The administration guide seems to suggest not, saying that "All Remote Access VPN users and endpoint computers must be configured in an Identity Provider for authentication. This applies to managed endpoint computers and non-managed endpoint computers." Is that right? Would we need to enrol all personal devices before users could VPN connect from them?
Apologies again for the lengthy post, thanks for reading, and many thanks in advance for any advice.
Rob
