Configure Azure AD SAML SSO with Cisco ASA AnyConnect VPN

Security · Azure AD · Cisco ASA

As the cloud-only model continues to grow, we are seeing more environments without a legacy on-premises Active Directory domain. Whether this is your situation or you simply want to use modern web-based authentication, this article is for you.

Although I strongly believe Azure AD is not a replacement for an on-premises domain, Microsoft's continued development has proven it to be a viable solution for organizations of many sizes. I had some difficulty completing this setup in ASDM, so this article covers the steps through SSH and the CLI.

What you need

  1. A Cisco ASA device with SSH and ASDM access.
  2. Azure AD. The free version works, but paid versions are required to enforce Conditional Access policies such as MFA.
  3. An existing VPN tunnel group. Make sure its name does not contain spaces, or you may have trouble accessing the metadata in Section 3.

Section 1: Azure AD configuration

  1. Sign in to the Azure AD portal.
  2. Go to Enterprise Applications → All Applications → New Application.
  1. Under Add an Application, select Non-gallery application and enter a name. In this example, I used AnyConnect-SAMLSSO. Select Add at the bottom of the blade.
  1. Once the application has been created, go to Single sign-on and select SAML.
  1. When the SAML configuration page loads, download the Base64 certificate from box 3.
  1. From box 4, record the Login URL, Azure AD Identifier, and Logout URL. These values translate into ASA terms as follows:
  • Azure AD Identifier (Azure AD) = IDP Entity ID (ASA)
  • Login URL (Azure AD) = Sign In URL (ASA)
  • Logout URL (Azure AD) = Sign Out URL (ASA)

Section 2: ASA configuration

  1. Connect to your ASA device over SSH using your preferred client.
  2. Use the following template to configure the CA trustpoint for the Azure AD identity provider and enroll the Base64 certificate downloaded in Section 1. I named the trustpoint AzureAD-IDP-Trustpoint, but you can choose another name.
config t
crypto ca trustpoint AzureAD-IDP-Trustpoint
    revocation-check none
    no id-usage
    enrollment terminal
    no ca-check
crypto ca authenticate AzureAD-IDP-Trustpoint
-----BEGIN CERTIFICATE-----
~~~PASTE THE CONTENTS OF YOUR BASE64 FILE HERE~~~
-----END CERTIFICATE-----
quit
  1. Copy the commands into a text editor and paste in the contents of the Azure AD Base64 certificate. The completed block should look similar to this example:
config t
crypto ca trustpoint AzureAD-IDP-Trustpoint
    revocation-check none
    no id-usage
    enrollment terminal
    no ca-check
crypto ca authenticate AzureAD-IDP-Trustpoint
-----BEGIN CERTIFICATE-----
&8OHhbNmtT9za@1FdAAAibGiZV55$@TpvLm2ZoPC55gC3YgO%R4lI4$THISISAFAKECERTm%Hqlm
tVmPT5$g3l3OmAmC11L2FhSrQA*uJl90JEw0hxip@@qLKTHISISAFAKECERTm*7bO8r*7vE&Lap8W546$Lf1MGKOkBNIOKICAf5B0Z!gF*HTHISISAFAKECERTafjGbl$7ddNsRuNzQVWFqgJpSXR^atO#^%t8mUTHISISAFAKECERTe9GhVyroMY87F%jCV#uyLMTtYibF0Bp#aoJ1pX#mocxl1OQEFzYrkZ%nQ%$kl8v28*4NO2C8C6QJWqUJDvy4Pojw&abTjg3t^CGgvY##6979D
-----END CERTIFICATE-----
quit
  1. Paste the completed block into your SSH client. Accept the certificate and confirm it installs successfully.
  1. Configure the SAML identity provider using the values recorded in Section 1, Step 6. In this block, the text surrounded by three slashes indicates information you must replace.
webvpn
  saml idp ///AZURE AD IDENTIFIER LINK///
  url sign-in ///AZURE AD LOGIN URL////
  url sign-out ///AZURE AD LOGOUT URL////
  trustpoint idp ///TRUSTPOINT NAME CONFIGURED IN STEPS 1-4///
  trustpoint sp ///NAME OF YOUR EXISTING EXTERNAL TRUSTPOINT///
  no force re-authentication
  no signature
  base-url ///YOUR ANYCONNECT VPN URL///
  1. Fill in the information from your Azure AD application. A completed command block should look similar to this:
webvpn
  saml idp https://sts.windows.net/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/
  url sign-in https://login.microsoftonline.com/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/saml2
  url sign-out https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
  trustpoint idp AzureAD-IDP-Trustpoint
  trustpoint sp VPN_Trustpoint
  no force re-authentication
  no signature
  base-url https://vpn.mycompany.com
  1. Paste the completed command block into your SSH client. This creates the SAML identity provider on the ASA.
  2. Apply the SAML identity provider to your existing VPN tunnel group. Creating a tunnel group is outside the scope of this guide.
tunnel-group ///YOUR EXISTING VPN TUNNEL GROUP/// webvpn-attributes
 authentication saml
 saml identity-provider ///AZURE AD IDENTIFIER LINK///
  1. Fill in your information. The result should look similar to this:
tunnel-group VPN_TunnelGroup webvpn-attributes
 authentication saml
 saml identity-provider https://sts.windows.net/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/
  1. Paste the completed block into your SSH client. This configures the tunnel group to use SAML authentication with the identity provider created in Steps 5–7.
  2. Save your configuration changes on the ASA:
write memory

Section 3: SAML metadata

Now that the ASA is configured, retrieve the SAML metadata and add it to the Azure AD application.

  1. Fill in your values and open the following URL:
https://yourvpnurl.com/saml/sp/metadata/TUNNELGROUPNAME

Using the sample data, the URL would be:

https://vpn.mycompany.com/saml/sp/metadata/VPN_TunnelGroup
  1. Open your URL. The SAML metadata XML should load.
  2. Find the AssertionConsumerService element and record its Location value. This becomes the Reply URL in the Azure AD application. Also record the entityID value near the top of the metadata.
  1. In the Azure AD portal, open your enterprise application and go to Single sign-on. In box 1, Basic SAML Configuration, select the pencil icon.
  1. Enter the ASA metadata values in the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) fields, then save.

Section 4: Users and groups

Now that the ASA and Azure AD SAML application are configured, specify which users or groups can access the application and, in turn, the VPN. You can instead disable assignment requirements to allow all users in your Azure Active Directory to access the application.

Enable sign-in for the application

In Azure AD, open your SAML application and go to Properties. Ensure Enabled for users to sign-in? is set to Yes. This globally enables sign-in whether you restrict access to selected users and groups or permit everyone.

Permit selected users and groups

To assign specific users or groups, set User assignment required? to Yes. Then assign users with free Azure AD or groups with Azure AD Premium from the Users and groups tab.

Allow all users

To allow all users in your Azure Active Directory tenant to access the SAML application, set User assignment required? to No.

Section 5: Azure AD Conditional Access

Optional section.

If you have Azure AD Premium, you can use Conditional Access policies to enforce controls that permit or deny access.

  1. In your Azure AD SAML application, open Conditional Access and select New Policy.
  1. Select Cloud apps or actions → Cloud apps → Include → Select apps, then find your SAML application.
  1. Select Grant → Grant access, then choose the controls users must satisfy. This example requires an MFA challenge. If you select multiple controls, choose whether users must satisfy one or all of them. Name the policy, enable it, and save.

Wrapping things up

Forced reauthentication

To force users to reauthenticate every time they connect to the VPN, enter the following commands and replace the placeholder values:

config t
webvpn
saml idp ///AZURE AD IDENTIFIER LINK///
force reauthentication
quit

With forced reauthentication, credential caching is ignored. Users must provide their credentials and satisfy Conditional Access, when enabled, every time they connect.

Important to know

If you change the SAML identity provider, remove it from every tunnel group where it is applied, then reapply it for the changes to take effect:

config t
tunnel-group ///YOUR VPN TUNNEL GROUP/// webvpn-attributes
no saml idp ///AZURE AD IDENTIFIER LINK///
saml idp ///AZURE AD IDENTIFIER LINK///
quit
wr

You should now be able to connect to your AnyConnect VPN using web-based Azure AD authentication. If you encounter a problem, check the common issues below.

Common issues and fixes

1. The SAML authentication window opens in an external browser or does not appear

If you use SAML authentication with AnyConnect 4.4 or 4.5 and deploy ASA version 9.7.1.24, 9.8.2.28, or 9.9.2.1, the default SAML behavior is the embedded browser. Those AnyConnect versions do not support it.

Options:

  • Enable the saml external-browser command in the tunnel group configuration so AnyConnect 4.4 and 4.5 use the external native browser.
  • Upgrade AnyConnect to version 4.6 or later.

2. The SAML section is blank in ASDM

  1. In the ASDM toolbar, select Tools → Show Commands Ignored by ASDM on Device.
  1. Your SAML identity provider configuration should appear here. ASDM is ignoring the commands and not displaying them in its GUI, but they remain applied to the device.

This error usually appears after the SAML identity provider changes without being removed from and reapplied to the tunnel group. Remove and reapply it with this command set:

config t
tunnel-group ///YOUR VPN TUNNEL GROUP/// webvpn-attributes
no saml idp ///AZURE AD IDENTIFIER LINK///
saml idp ///AZURE AD IDENTIFIER LINK///
quit
wr

On some stubborn ASA devices, removing and reapplying the identity provider may not fix the problem. Reboot the ASA, making sure to save the configuration first:

wr
reload

After the ASA reboots, test the connection again.