Keycloak - Browser-Based authentication for VPN users

[PCAILLE]

Hello,

We currently want to enable MFA for our partners connected via IPsec tunnel.

To achieve this, we have an IAM (Keycloak) that we want to use to redirect partners, allowing them to access certain resources.

I found the following documentation on configuring Keycloak to authenticate user accounts for access to the SmartConsole: https://community.checkpoint.com/t5/Management/Keycloak-SAML-Authentication-for-SmartConsole/td-p/18...

Keycloak is configured as described in the above documentation (custom client scope) and as an Identity Provider for Browser-Based Authentication (cf. attached screens CHKP_config1 and 2)

What we are looking for is the remaining configuration needed to enable MFA. Specifically:

1. What do we have to do to redirect VPN partners to the Keycloak Portal?
2. Which source criteria in Security Policies (e.g., sources to target, Identity tags, Access Roles, User Groups) need to be set?

Additionally, are there any other configuration steps required ?

Thanks,

Regards,

Thibaut

[PhoneBoy]

If your intention is to use Keycloak to authenticate Remote Access users, you will have to create another SAML provider (i.e. you cannot reuse your existing one) and follow the relevant steps.

[PCAILLE]

Actually, the Keycloak provider is not currently used for any user authentication (we only followed the documentation part that focuses on the Keycloak configuration). We would like to set up authentication only for Remote Access users and not for SmartConsole access as described in the documentation.

[the_rock]

Did you follow the links I sent?

Andy

[Daniel_Kavan]

Also, when we say Remote Access VPN users, that includes support for SSLVPN users too right?   Not just the fat endpoint security client?  RE: SAML Support for Remote Access VPN (checkpoint.com)

[PhoneBoy]

I assume it will work if invoked via MAB portal, which supports SAML auth.

[Daniel_Kavan]

It doesn't look like it.   In the known limitations section at the bottom of SAML Support for Remote Access VPN (checkpoint.com), it says 

• This feature supports only IPsec VPN

   clients.

[PhoneBoy]

Appears to be supported in Unified Policy mode: https://support.checkpoint.com/results/sk/sk170775 

[the_rock]

Hey Thibaut,

I agree with what Phoneboy said. Just follow below steps (youtube video by Peter Elmer is super helpful)

Andy

https://support.checkpoint.com/results/sk/sk172909

https://www.youtube.com/playlist?list=PLBfjYlNj4w1vJJBCdwJCAta4kvxI0t0Fb (part 4)