SAML Profile using http:// when it should use https://

[jmjh]

I am attempting to setup Azure AD login for Cisco AnyConnect. I have setup the SAML Connection profile on the ASA, and the Cisco AnyConnect app in Azure AD. When I go to login using the profile I created for this, it goes to an http:// page. If I adjust that to an https:// page it gives me the Azure login but then after logging in I get an error saying "Application with identifier 'http://....' was not found in the directory..."

How do I get this profile to use https:// instead of http://?

[Marvin Rhoads]

When you modify a SAML identity provider profile you need to de-associate it from the tunnel-group (aka connection profile in ASDM) and then re-associate it for it to take effect.

Reference:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi23605?rfs=iqvred

[jmjh]

Thank you but this does not resolve the issue. The problem that I am having with the profile is that it is trying to use an http:// address for the SAML identity provider when the SAML requires an https:// address. I can't see where in the profile configuration on the ASA (5516) that I can change this.

[Marvin Rhoads · Accepted solution]

The SAML iDP, including the access scheme (i.e., https), is configured in the webvpn section of the ASA configuration. It should look something like this:

webvpn
  saml idp https://sts.windows.net/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/
  url sign-in https://login.microsoftonline.com/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/saml2
  url sign-out https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
  trustpoint idp AzureAD-IDP-Trustpoint
  trustpoint sp VPN_Trustpoint
  no force re-authentication
  no signature
  base-url https://vpn.mycompany.com

In ASDM that is done under Configuration > Remote Access VPN > Clientless SSL VPN Access > Advanced > Single Signon Servers. For some reason ASDM defaults to http in that section even though no SSO server I've ever seen uses anything but https.

[jmjh]

That worked! Thank you so much!