ASA Anyconnect with SAML authentication notes

on

 

Security Assertion Markup Language (SAML) is an XML-based, open-standard data format used to exchange authentication and authorization data between parties, specifically between an identity provider (IdP) and a service provider.

User Agent
SP (Service Provider)
IDP (Identity Provider)

IDP and SP establish Trust

When an user wants to access a SP, he must first authenticate with IDP, after successful authentication, IDP generates a SAML ASSERTION, which is sent to SP, then the user can access SP.

The user exists in  IDP, SAML configuration specify what attribute to use to identify user, for example, use email address.

IDP side SAML configuration IDP XML and SP side SAML configuration SP XML called Metadata

Metadata: It is an XML based document that ensures a secure transaction between an IdP and an SP. It allows the IdP and SP to negotiate agreements.

Between IDP and SP: message exchange via BINDINGS: HTTP-POST, HTTP-REDURECT, HTTP-ARTIFACT 


Obtain the certificates that the IdP and firewall will use to sign SAML messages. If the certificates do specify key usage attributes, one of the attributes must be Digital Signature



In case of Azure as IDP, Anyconnect as SP

IDP needs Two info from ASA:

These info are in metadata, metadata URL is case-sensitive

show saml metadata TUNNEL-GROUP-NAME

or

https://<VPN URL>/saml/sp/metadata/<TUNNEL-GROUP NAME>

 a. Identifier (Entity ID)  - https://<VPN URL>/saml/sp/metadata/<TUNNEL-GROUP NAME> 
 

 b. Reply URL (Assertion Consumer Service URL) - https://<VPN URL>/+CSCOE+/saml/sp/acs?tgname=<TUNNEL-GROUP NAME> 


The Entity ID is a URI used to identify the issuer of a SAML request, response, or assertion.

A SAML Assertion Consumer Service (ACS) is responsible for receiving and processing SAML assertions from the IdP

Sign on URL is required for SP initiated.




ASA needs four info from Azure:

1. Azure IDP certificate: import to ASA as CA certificate
   config t 

 crypto ca trustpoint AzureAD-AC-SAML 
   revocation-check none 
   no id-usage 
   enrollment terminal 
   no ca-check 
 crypto ca authenticate AzureAD-AC-SAML 
 -----BEGIN CERTIFICATE----- 
 … 
 PEM Certificate Text you downloaded goes here 
 … 
 -----END CERTIFICATE----- 
 quit 

 2. Azure AD Identifier - This is the saml idp in our VPN configuration.

 3. Login URL - This is the URL sign-in.

 4. Logout URL - This is the URL sign-out.








Debug

debug webvpn saml 255





Cases:

error:
"Authentication failed due to problem retrieving the single sign-on cookie"

debug error:
.....
kROYnlRenpZSm52cjZ6dis4bHhCb3g0YURwYXlqdkU5dFdLMkl4NjBIcE5DMEM4VVlzbWQ1ejdndG5TVk4yNGhpZWVvaWViSVdUUUlCQnlyNDlabjFVPTwvZHM6WDUwOUNlcnRpZmljYXRlPjwvZHM6WDUwOURhdGE+PC9kczpLZXlJbmZvPjwvZHM6U2lnbmF0dXJlPjxzYW1scDpTdGF0dXM+PHNhbWxwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbHA6U3RhdHVzPjxzYW1sOkFzc2VydGlvbiBJRD0iRFVPXzUzYmY0M2ExOWIOct 10 10:34:33 [Lasso] func=xmlSecOpenSSLEvpSignatureVerify:file=/local/jenkins/workspace/fxplatform/Builds/release__2.6.1_fcs_hammersmith/build-smp-compile/fxos/linux/wrlinux/bitbake_build/tmp/work/corei7-64-wrs-linux/xmlsec1/1.2.20-r1/xmlsec1-1.2.20/src/openssl/signatures.c:line=493:obj=rsa-sha256:subj=EVP_VerifyFinal:error=18:data do not match:signature do not match

Oct 10 10:34:33 [Lasso] func=xmlSecOpenSSLEvpSignatureVerify:file=/local/jenkins/workspace/fxplatform/Builds/release__2.6.1_fcs_hammersmith/build-smp-compile/fxos/linux/wrlinux/bitbake_build/tmp/work/corei7-64-wrs-linux/xmlsec1/1.2.20-r1/xmlsec1-1.2.20/src/openssl/signatures.c:line=493:obj=rsa-sha256:subj=EVP_VerifyFinal:error=18:data do not match:signature do not match

Oct 10 10:34:33 [SAML] consume_assertion: The profile cannot verify a signature on the message
Oct 10 10:34:33
[SAML] consume_assertion:

[saml] webvpn_login_primary_username: SAML assertion validation failed

Cause:
Wrong IDP cert.












https://www.wiresandwi.fi/blog/asa-vpn-saml-authentication-some-tips-and-tricks


https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215935-configure-asa-anyconnect-vpn-with-micros.html


https://community.cisco.com/t5/security-documents/anyconnect-azure-ad-saml-sso/ta-p/3810013



Configure ASA AnyConnect VPN with Microsoft Azure MFA through SAML

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215935-configure-asa-anyconnect-vpn-with-micros.html



Configure Anyconnect with SAML authentication on FTD managed via FMC

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/216268-configure-anyconnect-with-saml-authentic.html



Decode SMAL response

Chrome, press Fn+F12 to open developer console, > Network tab, then access SAML login, copy the saml response payload to notepad ++, > plugins >  MIME Tools > Base64 decode by line

Comments

Post a Comment