06-09-2022 04:42 PM
Hi,
I'm trying to setup a SAML authenticated VPN on my ASA to Microsoft Azure AD. ASA Version: 9.14(2)15 on ASA 5516. AnyConnect Client 4.10(newest)
Problem: I've followed the Cisco configuration guide for SAML Auth with Azure AD and I can login to Azure AD; I connect with Anyconnect and choose the profile group that is setup for SAML, the MS login window comes up I put in my company email and password. The Microsoft window says I'm logged in and ask me if I want to stayed logged in, I say no. then a browser window opens on my ASA that tells me the URL is forbidden.
What's going on here? I've check and triple checked the settings. Any help would be very much appreciated.
Thanks in advance!
03-09-2023 06:16 PM
Hello,
I'm having the same issue. Where you able to fix this?
03-10-2023 11:17 AM
@mlopez1515 No I never found a solution. You will want to call Cisco and open a ticket with them.
11-08-2023 02:03 AM
hello; is any progress in this, please ?
I have the same problem; my opinion is that this message is not from Cisco side but as result of MS MFA authentication; but not able to prove it ...
Petr
11-09-2023 06:30 AM
While troubleshooting these types of problems in TAC we usually ask customers to provide HAR file with a connection flows:
https://toolbox.googleapps.com/apps/har_analyzer/
First thing that should be checked is whether IdP asks a browser to send assertion to the proper Assertion Consumer Service URL. It can be verified with below URL:
https://<fqdn>/saml/sp/metadata/<tunnel-group>
Sometimes users get redirected to the wrong URL. In some cases incorrect "portal-access-rule" can also block connections.
Without HAR, show tech output and debugs it will be rather hard to provide any other advise.
debug webvpn 255
debug webvpn anyconnect 255
debug webvpn session 255
debug webvpn saml 255
debug webvpn request 255
11-09-2023 09:34 PM
thank you; seems to be best to open the case
11-15-2023 07:20 AM - edited 11-15-2023 07:25 AM
In a recent customer case, the problem was indeed with the "portal-access-rule". The customer had a "deny any" value. Removing that fixed it. I suggested using a webvpn keepout value instead.
From what I figure, the portal-access-rule prevented the iDP (Duo SSO in the case I was working but it would apply to any iDP) from replying to the ASA with an HTTP POST message for the Assertion Consumer Service that's otherwise listening for the result.
12-07-2023 07:35 AM - edited 12-07-2023 07:36 AM
Thank you guys !
I had the exact same issue, and started to go crazy : Cisco ASA, Secure Client, Azure AD, SAML, and this blank window with "Forbidden"...
I used DART to have full logs, and found this line : Portal access rule priority 10 matched, action=denied, code= 403
I found this strange, because it's related to Clientless SSL. But, I found your topic, and I confirm, when I removed it, I went a step further.
Then, I add "log in denied. Your environment does not meet the access criteria defined by your administrator", which was caused by Dynamic Access Policy".
Now, everything is working as expected !
Thank you again
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide