Embedded Browser not supported error during SAML authentication with Azure (Remote Access VPN)

[jennyado]

Hi,

We are experiencing an issue with Remote Access VPN authentication using SAML against Microsoft Entra ID (Azure AD).

When users try to authenticate, the embedded browser used by the Check Point Endpoint client displays the following error :

 

 

Important details:

• The affected users do have Microsoft Edge up to date on their machines.

• The error only appears inside the Check Point Endpoint embedded browser, not in the regular system browsers.

• Environment:

  • OS: Windows (users affected)

  • Authentication: SAML with Microsoft Entra ID

  • Client: Check Point Endpoint Security (Remote Access VPN)

Our main questions are:

1. What browser engine does the Check Point embedded browser actually use on Windows?
   Is it based on IE, Edge WebView2 / Chromium, or something else?

2. Is Microsoft Edge WebView2 a strict requirement for the embedded browser to work correctly with modern Azure authentication?

At this point, everything works fine if authentication is performed using a full external browser, but fails with the embedded one.

Any guidance, official references, or similar experiences would be greatly appreciated.

Thank you in advance.

[the_rock]

Hey Jenn,

Im fairly positive I had seen another post while back where someone mentioned embedded browser is not supported. Let me see if I can find it.

[the_rock · Accepted solution]

@jennyado 

Could not find the post, but see if below helps.

https://support.checkpoint.com/results/sk/sk180395

[jennyado]

Thank you.

We configured idp_browser_mode to be embedded, but my question is whether, when this configuration is applied, the Endpoint Security agent uses an application to display the login screen within the agent itself, or if it uses a function of the browser that the user has installed on their PC.

[the_rock]

Im fairly certain its within agent itself.

[PhoneBoy · Accepted solution]

The embedded browser on Windows is an embedded variant of Internet Explorer.
Which means you should use an external browser for this, and, in fact, default_browser is the default from E88.40.
See: https://support.checkpoint.com/results/sk/sk180395 

[the_rock]

Ok, so it is same sk I was thinking of.