APM combining SAML and AD to work together
Hello,
I have working configuration of SSL VPN based on AD auth. Due to MFA requirements we decided to implement SAML authentication to cloud based provider.
I got this configuration working but it forces users to provide username twice, so i tried to find workaround for that, this is my policy:
What i did was:
- autenticate user with saml
- receive his username and assign it to username variable
- on the logon page hide the username field and try to push it into ad auth
- at this point the authentication fails with error in log: Auth (logon attempt:0): authenticate with '' failed
If i skip this and allow user to populate username field in logon page everything works fine.
Has anyone a clue what might be missing here? I even tried to map multiple values to username, force APM to assume domain name etc, but nothing helps.
OK, let's break this down. You needed a chain from SAML auth to the AD logon via the Logon page. You inserted the username variable so that it could be displayed but broke the chain there - you showed it to the user but hadn't included it in the form to pass it on to the AD auth. Now you have included it in the form, it is passed on to the AD auth. You could have skipped the variable assign and populated the form field directly from the SAML auth but for debugging purposes it is good to include that step anyway. Hopefully that makes sense now.