cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
configure & troubleshoot anyconnect

AnyConnect: Azure AD SAML SSO

3990
Views
40
Helpful
0
Comments

Preface: I had a hard time locating documentation for configuring AnyConnect with Azure AD as a SAML IdP - So I took some notes and thought I'd share. I hope it helps someone.

Azure Setup

Login to Azure Portal (https://portal.azure.com)

 

Click Azure Active Directory

AzureAD-SAML_1.png

Click Enterprise Applications -> New Application -> Non-Gallery Application

 

Give it a Name (I'll use AnyConnect-SAML) and click Add at the bottom.

 

AzureAD-SAML_3.png

 

Click the Single sign-on menu Item.

Select SAML

 

AzureAD-SAML_6.png

 

Download the Certificate Base64 from section 3 (We'll install this later)

 

Make note of the following from Section 4:

Azure AD Identifier - This will be the saml idp in our VPN configuration.

Login URL - This will be the url sign-in

Logout URL - This will be the url sign-out

 

At this point you have the Data Required to begin configuring the VPN Appliance.

We will need to come back here after configuring the VPN Tunnel-Group and grabbing the metadata.

 

VPN Configuration - CLI

 

Alright, we're going to do this on the CLI first, I might come back through and do an ASDM walk-through at another time.

 

Connect to your VPN Appliance, we're going to be using an ASA running 9.8 code train, and our VPN clients will be 4.6+

 

Please note there are SAML 2.0 minimum requirements (I believe they are ASA 9.7+ and AC 4.5+ otherwise SAML 2.0 isn't supported or you need to use external browser config… this is outside the scope of this walk-through)

 

First we'll create a Trustpoint and import our SAML cert.

 

config t

crypto ca trustpoint AzureAD-AC-SAML
  revocation-check none
  no id-usage
  enrollment terminal
  no ca-check
crypto ca authenticate AzureAD-AC-SAML
-----BEGIN CERTIFICATE-----

PEM Certificate Text from download goes here

-----END CERTIFICATE-----
quit

 

The following commands will provision your SAML IdP

 

webvpn
  saml idp https://sts.windows.net/xxxxxxxxxxxxx/ (This is your Azure AD Identifier from SSO Section 4 of Azure App)
  url sign-in https://login.microsoftonline.com/xxxxxxxxxxxxxxxxxxxxxx/saml2 (Login URL: SSO Section 4 of Azure App)
  url sign-out https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0 (Logout URL)
  trustpoint idp AzureAD-AC-SAML
  trustpoint sp (Trustpoint for SAML Requests - you can use your existing external cert here)
  no force re-authentication
  no signature
  base-url https://my.asa.com

Now you can apply SAML Authentication to a VPN Tunnel Configuration.

(Configuration of a VPN Tunnel Group or Group Policy is beyond the scope of this document)

 

tunnel-group AC-SAML webvpn-attributes
  saml identity-provider https://sts.windows.net/xxxxxxxxxxxxx/
  authentication saml
end

write mem

*Note: There's a feature with the SAML IdP configuration - If you make changes to the IdP config you need to remove the saml identity-provider config from your Tunnel Group and re-apply it for the changes to become effective.

 

Finishing up with the Azure AD App

 

We're now ready to grab the meta-data for our tunnel config and finish the Azure application configuration.

 

You can use a URL similar to below to view the SP metadata.

 

my.asa.com = the address at which my ASA is reachable

AC-SAML is the tunnel group name configured for SAML auth.

 

SP Metadata:

https://my.asa.com/saml/sp/metadata/AC-SAML (Also your Entity ID - Azure App Section 1)

AzureAD-SAML_5.png

 

In the metadata XML look for AssertionCustomerService, the Location field in this tag is the Reply URL for the Azure App In SSO Section 1.

 

Edit the Basic Configuration Section by clicking on the pencil in the top right.

Add the Entity ID & Reply URL

 

Click Save in the SAML Basic Configuration.

 

You should now have the basic communication between the ASA and Azure AD wired up.

 

You may need to add user permissions to the app  in Azure AD and conditional access policy for multi-factor, etc.

All beyond the scope of this walk-through, but highly recommended.