Identity Awareness using Azure AD

[adamhi]

Hi,

Possibly a daft question, but can anyone confirm if IA works against Azure AD as opposed to 'normal' AD? This is for an org that won't have any on prem AD at the end of the implementation.

I've had a look through the deployment guide for the version we would be implementing but it doesn't specifically mention Azure as being OK and I understand from our cloud architects that it's a bit different to AD as I know it.

Thanks in advance.

A.

[Shahar_Grober]

Hi Royi, 

Do you know if the Azure SAML + IDA integration supports WVD? 

it is supported on On-prem TS / Citrix with MUH (Identity Agent) 

 Did you look into this use case?

[Royi_Priov]

Hi @Shahar_Grober,

are you referring to WVD with multisession option? so few users are connection simultaneously?

[Netadmin2020]

@Royi_Priov 

I understood .Can you please so me a example with the identity tag?

thanx 

@adamhi 

We have a hybrid environment,that means we NEED ldap and azure ad Identity Awareness!

[Royi_Priov]

Hi @Netadmin2020 ,

You will need to:

1. Configure Identity Provider object and use this object in captive portal settings.
2. Configure new Identity Tag object with your AzureAD entity identifier (user / group identifier).
3. place this tag object in an Access Role.

You can use both Azure AD and LDAP with IDA, but not in parallel with captive portal.

For example, you can use captive portal with AzureAD (SAML) and other identity source with LDAP. Alternatively, one GW will use captive portal with SAML and the other one captive portal with LDAP. The reason is that the redirection action will be done once and we need to distinguish if this should be done with AD or with SAML.

[Netadmin2020]

check if these are correct.

 

 

  

[Royi_Priov]

After a quick brief, yes.

If this is still not working for you, please involve TAC to troubleshoot. Thanks!

[Arend]

Hi Royi,

(R81.10 sms and R81.10 gw's)

When creating the application according to the Check Point video 'Using Azure AD for Authorization'. it explains to use the non-gallery application but at the moment there is also the option for the gallery application by Check Point called "Check Point Remote Secure Access VPN".

What direction do we take when setting up 'Azure AD for Authorization' ?

video Using Azure AD for Authorization: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_IdentityAwareness_AdminGuide...

[RPdeBeer]

Does anyone knows if this works in Azure in an CloudGuard scale set (VMSS) configuration?

[Chris_Atkinson]

I'm sure Royi will be along to provide additional color here in due course.

Until then bootstrapping the IDA configuration for newly spun gateways is the primary caveat I see, there are new APIs coming in R81.20 that may help here.

[RPdeBeer]

Hi Chris,

Do you know whether it is at all possible on VMSS, if you were to configure it manually for example?

[Chris_Atkinson]

Don't see why you couldn't with gateways & management at the appropriate version but I've not tested it myself.

[RPdeBeer]

Because, so far I see, you are not able to reuse the Azure AD object for the second gateway which is created for the first gateway during the IA wizard.

[Chris_Atkinson]

R81 or above? Also to be clear you can use said object with additional non-IaaS gateways problem free?

[RPdeBeer]

Sorry, forgot to mention the version we are running on. We are using R81.10 CloudGuard IaaS. 

We don't have non-IaaS gateways in this environment. 

P.S. Yesterday we saw a new product from Check Point in the Azure marketplace: Check Point Identity Awareness. When we wanted to test this product today, we saw that it had been removed from the marketplace again.