|
Name
|
Enter the name for the SAML single sign-on server object.
|
|
Identity Provider Entity ID
|
Enter the URL that the SAML IdP defines to uniquely identify a service provider.
Enter the URL for a metadata XML page that describes how the SAML Issuer responds to requests.
|
|
SSO URL
|
Enter the URL for signing in to the SAML identity provider server.
|
|
Logout URL
|
Enter the URL for signing out of the SAML identity provider server.
|
|
Base URL
|
Enter the URL that redirects users back to Firewall Threat Defense after the identity provider authenticates them. This should be the access interface URL configured for the Firewall Threat Defense remote access VPN.
|
|
Identity Provider Certificate
|
Enter the IdP certificate enrolled into the Firewall Threat Defense to verify the signed messages.
Select an identity provider certificate from the list or click Add to create a new certificate enrollment object.
For more information, see Manage Firewall Threat Defense certificates.
You must enroll all of the Microsoft Azure registered application CA certificates as Trustpoints on the Firewall Threat Defense. The Microsoft Azure SAML identity provider is configured on Firewall Threat Defense for the initial application. All connection profiles are mapped to the configured MS Azure SAML identity provider. For each of the MS Azure applications (other than the default), you can choose the required trustpoint(CA certificate) in the connection profile configuration of the remote access VPN.
For details, see Configure AAA Settings for Remote Access VPN.
|
|
Service Provider Certificate
|
Firewall Threat Defense certificate, which will be used to sign the requests and build circle of trust with IdP.
If you have not enrolled internal Firewall Threat Defense certificates, click + to add and enroll a certificate. For more information, see Manage Firewall Threat Defense certificates.
|
|
Request Signature
|
Select the encryption algorithm to sign the SAML single sign-on requests.
The signatures are listed from weakest to strongest: SHA1, SHA256, SHA384, SHA512. Select None to disable encryption.
|
|
Request Timeout
|
Specify how long users can complete the single sign-on request (SAML assertion validity duration). The SAML IdP has two time outs: NotBefore and NotOnOrAfter. The Firewall Threat Defense validates if its current time is within the time range of (lower limit) NotBefore and (upper limit) the smaller of NotBefore plus timeout and NotOnOrAfter. Thus, if you set a timeout longer than the IdP's NotOnOrAfter timeout, the specified timeout is ignored and the NotOnOrAfter timeout is selected. If the sum of the specified timeout and the NotBefore timeout is less than the NotOnOrAfter time, Firewall Threat Defense timeout overrides the timeout.
The timeout range is 1-7200 seconds; the default is 300 seconds.
|
|
Enable IdP only accessible on Internal Network
|
Select this option if the SAML IdP resides on the internal network. Firewall Threat
Defense acts as a gateway and establishes communication between the users and IdP using an anonymous webvpn session.
|
|
Request IdP re-authentication on Login
|
Select this option to authenticate user at each login even if the previous IdP session is valid.
|
|
Allow Overrides
|
Select this check box to allow overrides for this single sign-on server object.
|