Clientless VPN with SAML

[fhk-cwempe]

Hello,

I successfully configured a Tunnel-Group to use SAML with Cisco Secure Client (aka AnyConnect).

Now I want to enable SAML on the DefaultWEBVPNGroup.
This works for the VPN-Client.

But when I open the ASA website in my browser an Login via SAML I cannot reach the correct website.
First I get a "you have been logged out" page and then I get stuck in a SAML-login loop.

(Same for the other Tunnel-Group)

But I want to reach the site where the user can download the VPN client.

What am I doing wrong?
Do I need to enable some special option?
Or is my SAML configuration wrong?

[zeuscyril]

can you share the details like asa model and version and what SAML provider are you using

[fhk-cwempe]

Sure.

Hardware: FPR-1140
Cisco Adaptive Security Appliance Software Version 9.18(4)22

SAML Provider is OpenText NetIQ Advanced Authentication.

[zeuscyril]

Hi

You can follow this link for reference. this is for Okta i think this will help you. This particular configuration works in okta perfectly. please have a look

https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Cisco-ASA-VPN.html

[zeuscyril]

Cisco announced below but you can try once with given reference before.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa916/asdm716/vpn/asdm-716-vpn-config/webvpn-configure-users.html

Cisco announces the feature deprecation for Clientless SSL VPN effective with ASA version 9.17(1). Limited support will continue on releases prior to 9.17(1). Further guidance will be provided regarding migration options to more robust and modern solutions (for example, remote Duo Network Gateway, AnyConnect, remote browser isolation capabilities, and so on).

[fhk-cwempe · Accepted solution]

I found the issue myself.

There was some kind of caching problem in my browser.
Deleting all browser data fixed the issue.

Thank you anyway.