cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3869
Views
0
Helpful
2
Replies

Anyconnect SAML auth to Azure AD SSO - not doing SSO

Peter Cresswell
Level 5
Level 5

Hi,

Has anyone used AnyConnect SAML auth (on ASA) using Azure AD SSO as the IdP?

I have it configured and can log in ok, but it's prompting me for my credentials where is should support Single Sign On since my PC is AAD joined...

Has anyone been able to make it work using SSO with either this or any other SAML IDP?

 

I'm using ASAv 9.9.2.32, and Anyconnect 4.6.02074, Windows 10.

 

I did wonder if its related to the new embedded browser (since IE can authenticate SSO without prompting for credentials to all other AAD integrated apps ok). I tried the "saml external-browser" command under the tunnel-group config to switch it back, but there was no noticeable difference, it still appeared to be using the embedded browser.

 

Thanks,
Peter

2 Replies 2

Sloanstar
Level 5
Level 5

Did this ever get resolved? Looking to setup something very similar to the environment you described.

Yes it’s working :)

it required this command to not prompt for auth and use Sso:

 

Saml idp <uri>

  No force re-authentication

 

The biggest frustration with this solution is there is apparently no way to have the ASA evaluate claims that are sent back and use them for Dynamic Access Policies. But if all users will get the same policy it seems to work great!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: