ASA AnyConnect VPN with Microsoft Azure MFA through SAML

[Manish Manwal]

we configure ASA AnyConnect VPN with Microsoft Azure MFA through SAML. when we connect VPN its given an error "Authentication failed due to problem retrieving the single sign-on cookie". we have done below troubleshooting.

• Restart the ASA.
• Log in to the ASA via CLI and verify time by issuing the command Show Clock.
  • If the time is not correct, verify your NTP time sync configuration.
• Set the SAML Identity provider to none, and then set it back to your configured SAML IdP.
• Remove the SAML configuration from the tunnel group on the ASA, save the configuration temporarily without the SAML configuration.
• Re-enable SAML Auth in tunnel group via the following commands in the CLI using your Entity ID:
  • ciscoasa(config-tunnel-webvpn)# no saml identity-provider https://
  • ciscoasa(config-tunnel-webvpn)# saml identity-provider https://
  • debug the Webvpn and its showing "

webvpn_login_primary_username: SAML assertion validation failed
[SAML] consume_assertion: The profile cannot verify a signature on the message"

[Rob Ingram]

@Manish Manwal judging by the error "cannot verify a signature on the message" - I wonder if the certificate used is not trusted and you've not imported?

[Manish Manwal]

hi Rob,

identity provider and service provider both certificate has imported in firewall and both are valid til November

i can also see below error in debug. can you help here ?

func=xmlSecOpenSSLEvpSignatureVerify:file=signatures.c:line=493:obj=rsa-sha256:subj=EVP_VerifyFinal:error=18:data do not match:signature do not match
.

[Marvin Rhoads]

It's usually due to the Azure certificate having changed. Microsoft updates the certificate when you finalize the app setup in Azure. Double check that the certificate you imported on the ASA is the same one currently presented by Azure.

[Manish Manwal]

Hi Marvin,

certificate is same, i also download latest certificate and imported to ASA. but same issue.

[Manish Manwal]

after import certificate and disable and re enable SAML identity provider, we not receive above error, now we getting "login Denied" error.

can you help here. below is the debug logs

saml_ac_token_remove: SAML ac token being looked 73289FA84675DBCB096DB69
saml token ID 73289FA84675DBCB096DB69 removed from table
[SAML] saml_is_idp_internal: getting SAML config for tg SSL-VPN
#0x00007fb121de6290 (GET). Request line:/+webvpn+/webvpn_logout.html
#0x00007fb121de6290 Hand-off to emWeb.

[Marvin Rhoads]

"Login denied" is typically something on the iDP side. You should be able to check the logs there for more details.

I have seen some people successfully use Fiddler app to debug the https communications between the client and iDP during a SAML authentication process.

https://docs.telerik.com/fiddler/configure-fiddler/tasks/decrypthttps

[Manish Manwal]

i cant find any error in fiddler regarding vpn error.

one more error we are getiing in debuging : Dynamic access policy terminated the connection.

but no policy created yet for remote vpn

[Serpent2010]

I have the SAML authentication taking extreme delay to load the username page, password entry, then verification.

All that takes 7 minutes but at the end is connected with no slowness or asp drops.

Any idea?

[Eagen OBrien]

I am having same issue. Anyconnect authentication failed due to problem retrieving the single sign-on cookie. Configuration is correct, Certs are correct, re-apply config,etc.. One of my ASA is working but the other is having the issue. I get this from debug.

Jun 24 12:37:14 [SAML] consume_assertion: When looking for an assertion we did not found it.
Jun 24 12:37:14
[SAML] consume_assertion:

[saml] webvpn_login_primary_username: SAML assertion validation failed

any help would be appreciated.

[Serpent2010]

Do traffic capture and see the traffic flow behavior.
The root cause for my case was that the firewall blocked a Microsoft website that was used for the authentication process for SAML.
The website was blocked because the website was not listed in MS documentation of SAML’s firewall requirements.
So, I did multiple captures for many users when I noticed all of them trying to reach that website. I opened the ports for that website and immediately fixed it.

[Eagen OBrien]

Verified, and just to make sure I set allow any any to make sure I am not blocking anything and still same issue.

[Manish Manwal]

check if there is any DAP configured in ASA

[Manish Manwal · Accepted solution]

i resolved this issue by removing Dynamic access policy from ASA.