Configure SAML SSO authentication

SAML SSO authentication allows users to authenticate once with their identity provider and access the VPN without requiring separate credentials. This method improves user experience while maintaining security standards.

Before you begin

Ensure that you review Prerequisites for SAML SSO, Guidelines for SAML SSO authentication, and Limitations for SAML SSO.

Procedure

Step 1

Choose Secure Connections > Remote Access VPN

Step 2

To configure SAML SSO authentication for a new remote access VPN policy:

  1. Click Add to create a remote access VPN policy.

  2. Configure the protocols, devices, and connection profile for the policy.

  3. From the Authentication Method drop-down list, choose SAML.

  4. From the Authentication Server drop-down list, choose a SAML single sign-on server.

  5. Configure the required settings for the remote access VPN policy.

  6. Click Finish to save the remote access VPN policy.

Step 3

To configure SAML SSO authentication for an existing remote access VPN policy:

  1. Click the edit icon next to the remote access VPN policy.

  2. Click the edit icon next to the connection profile that you want to modify.

  3. Click the AAA tab.

  4. From the Authentication Method drop-down list, choose SAML.

  5. From the Authentication Server drop-down list, choose a SAML single sign-on server.

  6. Check the Override Identity Provider Certificate check box to override the primary SAML IdP certificate with a profile-specific certificate to support multiple SAML applications for an IdP.

    The primary identity certificate is configured in the single sign-on server object.

  7. From the drop-down list, choose the IdP certificate.

  8. In SAML Login Experience, configure a browser for SAML web authentication:

    • VPN client embedded browser—Select this option to use the embedded VPN client browser for VPN-only web authentication.

    • Default OS Browser—Select this option to use the system's default browser for web authentication. You can use SSO and methods like biometric authentication that are not supported in the embedded browser. This option requires an external browser package which is by default Default-External-Browser-Package. To change this browser package, edit the remote access VPN policy, click the Advanced tab and choose a browser package from the Package File drop-down list.

  9. Click Save to save the remote access VPN policy.