ASA SAML with Entra ID Issue

[jf1134]

Having an issue getting the SAML configuration working with Entra ID with a new ASA. I have one setup in our other Azure Tenant that works fine. It's an older ASAv. I went through the same setup process.

ASA Version: 9.20(2)10

When I am setting up the SSO server on the ASA it looks like there a new field that's not on the other one. Local Base URL. 

It seems like when I login, it's not able to contact Entra because it just prompts for a username and password and doesn't go to Secure Client Login

In Azure:
EntraID Identifier: https://public.domain.com/saml/sp/metadata/Support
Reply URL: https://public.domain.com/+CSCOE+/saml/sp/acs?tgname=Support

[balaji.bandi]

check example 9.18 onwards its changed :

https://www.securityccie.net/2023/08/07/asa-dns-load-balancing-with-saml/

check the thread :

https://community.cisco.com/t5/vpn/saml-for-cisco-asa-in-load-balancing-group/td-p/4773002

[jelloyd]

If the autentication challenge is just asking for username/password through the AnyConnect GUI itself, then it's not invoking SAML authentication, which will pop up in separate AnyConnect embedded browser window.  This tells me that it may be hitting the wrong tunnel-group (connection profile), where SAML is not enabled.

Can you check that the client's XML profile is configured to connect to the right tunnel-group on the headend VPN device?  It will be in the <HostEntry> section at the end of the XML profile, and should looke something like this:

<HostEntry>

<HostName>VPN Connection</HostName>

<HostAddress>vpn-asa.company.com</HostAddress>

<UserGroup>AnyConnect_Group</UserGroup>

</HostEntry>

 And then check the tunnel-group configuration on the ASA to make sure that the group-url is setup correctly.  For instance, in the example above, the group-url would need to be:

  https://vpn-asa.company.com/AnyConnect_Group

If it still fails, can you gather the following debugs from the ASA when trying to conenct?

  debug webvpn saml 255

  debug aaa-common 255