FTD - AnyConnect Certificate & SAML Authentication

[kylerossd]

Hello,

Documentation seems to be light here.  Is it possible to do double authentication using a signed certificate and SAML?  The goal would be to authenticate to the ASA with cert, perform SAML auth to the 2FA and authorize the certificate on Cisco ISE.  There is no saml group per se so I don't believe I can use the "secondary-authentication-server-group" command. 

TLDR: can I use authentication saml certificate command?

aaa-server ISE protocol radius

authorize-only

interim-accounting-update periodic 1

dynamic-authorization

aaa-server ISE (outside) host aa.bb.cc.dd

key *****

tunnel-group CERT-DUO type remote-access

tunnel-group CERT-DUO general-attributes

address-pool pool

authorization-server-group ISE

accounting-server-group ISE

tunnel-group CERT-DUO webvpn-attributes

authentication saml certificate

saml identity-provider https://explorer.cisco.com/dag/saml2/idp/metadata.php

[Marvin Rhoads]

I don't think this is supported. I based that on the config guide which tells us:

The authentication options are AAA only, certificate only, multiple-certificate only, AAA and certificate, AAA and multiple-certificate, and SAML.

Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/configuration/vpn/asa-914-vpn-config/vpn-groups.html