Remote Access: Realm "Discovered Identities" using SAML

[t1m1]

Hello,

I have set up a FTD managed by cdFMC for remote access VPN. 
For authentication I use SAML with Azure AD as an IdP. The authentication itself is working fine, but the user identity of the session viewed in FMC has "Discovered Identities" as it's realm. 
I also have an AD Realm with LDAP configured in the FMC and it is also used as authorisation for Group Policy assignement.
An AzureAD Realm is also configured. And using ISE is not an option for me. 

When using radius I get "AD-Realm\username" but using SAML I just get "Discovered Identities\username".
I want to use the user identity for the ACL. 

What am I missing to fix this? 

[Aref Alsouqi]

Please bear with me on this. I think the reason why it's showing as "discovered identities" with SAML is because the FMC would have direct visibility of the users context in this case, and their contexts get passed from a third-party, Azure in this case. If memory serves, that was the case with the old Firepower agent. On the other side with LDAP realm configured on the FMC, the queries will be directly done by the FMC to the AD. In that case there is no broker for the FMC to get those contexts. Either way you should still be able to configure the rules with the user IDs I assume.

[t1m1]

I have the Azure AD realm added into the FMC. It can download the users and groups. But when loging in with RA-VPN the user isn't liked to the realm for ACLs.
The realm has two options. I try to use Authenticate with [...] RA-VPN:

Offical documentaition only refers to ISE. No documentaion for SAML realm for RA-VPN.
I don't know why it is stated in the realm configuration if it would not be possible. 

Is it even possible? And if so, how do I need to configure it?

[MHM Cisco World]

Do you use mapping of SAML attribute to group-policy ?

MHM

[t1m1]

Currently this is done with LDAP on the AD. 
SAML is just for authentication, and it can't be applyed for authorisation. 
But even with this setup the FMC doesn't recognize the realm of SAML. Even if the realm is added to the FMC.
I suppose it deasn't ment to work like this. But I don't want to give up yet. That's the reason of this post. 

[MHM Cisco World]

Sure it not recognize SAML realm because there is nothing like this.

I will check group-policy using SAML and update you

Goodluck abd thanks for waiting 

MHM

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/secure-client-5/221173-configure-dynamic-group-policy-assignmen.html 

check this 

MHM

[t1m1]

My problem is not the group policy assignment. The problem is the user identity.
The FMC knows the users from "SAML - Azure AD" realm and the users are authenticated by the same SAML IdP. Yet somehow it won't link the users to the realm for ACLs. 

When I login via SAML SSO I get this for my user activity:

The SAML - Azure AD realm is setup withn this type:

And user are loging in like this "username@example.com" . I can't add the realm to the SSO-server object like I can do with radius. 
Is there a SAML attribute missing that states the realm of the users or why doesn't it link the users to the realm? 

[MHM Cisco World · Accepted solution]

[t1m1 · Accepted solution]

The "Remote Access Remark" slide gave me the right hint to make it work.
The "SAML - Azure AD" realm is probably useless, but I could link it to the AD/LDAP realm 

I had to change the Unique User Identifier in the SAML claims to the username@<AD.local> with join() transformation.
Now the FMC links the SAML session to my on-prem AD.

I hope it would be possible to link it to the "Azure AD" realm in the future to capsulate it from the on-prem AD. 
This works for now. But I won't give up on "Azure AD" realm yet. 

[MHM Cisco World]

We as group of community try do best to help each other 

Happy issue is solved finally 

Have a nice day 

MHM