Cisco Anyconnect SAML- authentication failed due to navigation timeout

[jniravel]

Cisco AnyConnect not able to login via SAML integration. The login is successful when using the browser through the outside interface domain but while using client VPN, there is timeout after blank screen. How to fix this?

[Marvin Rhoads · Accepted solution]

This would normally indicate that the url sign-in that is in the webvpn section of your ASA configuration is referencing a URL that is not resolvable by or responding to the AnyConnect client.

[jniravel]

@Marvin Rhoads : When I try to hit the outside URL on browser, I am able to authenticate through Okta with the same profile and download the AnyConnect client.
This issue occurs while using the VPN client.  

[Marvin Rhoads]

What is your AnyConnect version?

[jniravel]

Version is 4.10.05111

[Marvin Rhoads]

Your version checks out OK then. It should be compatible with SAML authentication.

Troubleshooting at this point can be tricky. However if you are handy with reading debugs you can use Fiddler to capture the https traffic and provide the certificate so that you can decode it to see what is being sent and why the reply is sending that error code.

https://docs.telerik.com/fiddler/configure-fiddler/tasks/decrypthttps

[Serpent2010]

Hello,

I have some users getting extremely slowness when clicking on cisco AnyConnect to get SAML authentication. it took them 7 minutes to complete the authentication process but after getting connected everything is normal and no asp drop. 

The odd this delay is occurring to some users not all of them for the same tunnel group,

The SAML metadata is matching with any other tunnel group that has no issue

Any idea?

Thanks