Anyconnect with SAML connection issue

[StevenEdmunds6666]

Hi All,

I have configured Cisco AnyConnect to authenticate with SAML and O365.

When I connect, I am presented with the login page at which point I enter the password and then authenticate from my mobile phone. However, when it's 'authenticated' I get a message saying, 'You are Disconnected. You may now close this browser tab'. 

I have also noticed that even though it's gone through, the VPN doesn't actually connect.

The only thing that I have noticed which looks odd to me is that the 'Login URL' and the 'Logout' URL appear to both be the same in the Azure side SAML page.

***Just found this message when authenticating: "Failed to consume SAML assertion. reason: The profile cannot verify a signature on the message." Have tried to re-enable SAML auth in tunnel-group but no luck.***

Thanks for reading and any questions, please let me know.

Steven

[StevenEdmunds6666]

I have also realised that I may also have an issue with my certificate or config. Even though the cert is applied on the ASA, when I try to connect using AnyConnect, I get the message that 'Certificate does not match the server name'

This can be ignored - was because I wasn't connecting via the correct name on the AnyConnect client.

[engineer467]

Hello Marvin,

I am getting a similar error in the debug saml, [SAML] consume_assertion: assertion is expired or not valid.

I doublechecked the Assertion Consumer Service URL and SP Entity ID, all seems okay.

Any insights? Thanks a lot.

[Marvin Rhoads]

@engineer467 

Assuming the SAML IDP is using a currently valid certificate (easy enough to check), I would then check the time and date in your firewall.

[engineer467]

Hello Marvin,

Thanks for responding. I checked all of them and they looked fine. Then I
came across this cisco bug id (
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvi23605). So
deleting the SAML config and reconfiguring worked for me.
Appreciate your quick response.

[Marvin Rhoads]

Ah yes, that bug is a pitfall. Newer versions of ASA and ASDM even warn you of if when changing your SAM configuration.

[engineer467]

Oh I didn't know that. Hope they do the same for FDM users as well.

[engineer467]

Or just fix the issue. lol

[Marvin Rhoads]

It was explained to me an an issue with the open source Lasso software library that Cisco uses. Like so many open source projects, if it's not actively maintained there are limitations to what can be done. (Of course, Cisco could fork it like they do with openSSH but I guess it's not considered a big enough problem for that.)

https://lasso.entrouvert.org/