Question
ZTNA w/ SAML breaks after upgrade from 7.2.8 to 7.4.6
I'm using SAML auth with my ZTNA proxy-policy. Everything worked great until I upgraded from 7.2.8 to 7.4.6.
No config changes were made.
This is a 91G model, which according to docs should still support full proxying in 7.4 and above.
The root of the problem is that the Gate (SP) is no longer re-directing the client to the FAC (IDP) for SAML auth. When the client requests https to the ZTNA server, it presents its EMS certificate and is immediately granted access. Prior to the upgrade, it was presented a SAML login page from FAC and everything worked as expected.
Is there more/different configuration in v7.4.6 ?
config firewall access-proxy
edit "ztna_https_faz"
set vip "ztna_https_faz"
config api-gateway
edit 1
config realservers
edit 1
set ip x.x.x.x
next
end
next
edit 2
set service samlsp
set saml-server "saml_sp_faz"
set saml-redirect disable
next
end
next
end
config firewall proxy-policy
edit 6
set uuid 2d25fdb0-9dde-51ef-93ff-760c19e3bee0
set name "ztna_faz_allow"
set proxy access-proxy
set access-proxy "ztna_https_faz"
set srcintf "AT&T-ISP"
set srcaddr "all"
set dstaddr "all"
set ztna-ems-tag "EMS1_ZTNA_all_registered_clients"
set action accept
set schedule "always"
set logtraffic all
set groups "saml_groups"
set ssl-ssh-profile "certificate-inspection"
next
end
config user group
edit "saml_groups"
set member "saml_sp_faz"
next
end
config authentication scheme
edit "ztna_saml"
set method saml
set saml-server "saml_sp_faz"
set saml-timeout 30
next
end
config authentication rule
edit "ztna_saml"
set srcintf "AT&T-ISP"
set srcaddr "all"
set dstaddr "faz_x.x.x.x"
set active-auth-method "ztna_saml"
next
end
config firewall vip
edit "fac_saml"
set uuid 2c4b8984-cdd4-51ef-0056-45e0ad38181a
set extip x.x.x.x
set mappedip "x.x.x.x"
set extintf "AT&T-ISP"
set portforward enable
set extport 9999
set mappedport 443
next
end
