Microsoft Entra ID SAML Authentication with WatchGuard Access Portal Integration Guide

Deployment Overview

The SAML authentication server in Fireware 12.11 or higher can integrate with several services. After you configure the SAML authentication server on the Firebox, you can use it to integrate with the Access Portal.

This integration guide describes how to configure SAML authentication through the Access Portal with Microsoft Entra ID (formerly known as Azure Active Directory) as the Identity Provider. When you configure Single Sign-On to use SAML authentication, users can log in through a single portal and have access to multiple services.

For information about the integration end result, go to the Test the Integration section.

Contents

• Microsoft Entra ID SAML Authentication with WatchGuard Access Portal Integration Guide
• • Deployment Overview
  • Contents
  • Integration Summary
  • Test Topology
  • Enable the Firebox SAML Authentication Server
  • Configure the Access Portal
  • Configure Microsoft Entra ID
  • • Create a Microsoft Entra ID Group and User
    • Configure a SAML Application
  • Complete SAML Authentication Server Setup
  • Complete Firebox Access Portal Setup
  • Test the Integration

Test Topology

Microsoft Entra ID communicates with various cloud-based services and service providers with the SAML protocol. This integration uses Microsoft Entra ID to communicate with a WatchGuard Firebox over a public Internet connection.

The Access Portal is a subscription service. Before you can enable the Access Portal feature and configure it on your Firebox, you must add an Access Portal license to your Firebox feature key.

Enable the Firebox SAML Authentication Server

To enable the Firebox SAML authentication server:

1. Log in to Fireware Web UI at:
   https://<your Firebox IP address>:8080
2. From the left navigation, select Authentication > Servers.



3. Select SAML.
   The SAML settings page opens.
4. Select Enable SAML.
5. In the IdP Name text box, type a name for the identity provider. In our example, we type Entra_ID_SAML.
6. In the Host Name text box, type an FQDN that resolves to the Firebox external interface.
7. Keep the IdP Metadata URL text box blank for now, we add the IdP settings later.



8. Click Save.

Configure the Access Portal

To configure the Access Portal on your Firebox:

1. Log in to Fireware Web UI.
2. From the left navigation, select Subscription Services > Access Portal.
   The Access Portal page appears with the Applications tab selected by default.
3. Select the Enable Access Portal check box.



4. Select the User Connection Settings tab.
5. In the Authentication Servers section, from the Authentication Servers drop-down list, select the SAML authentication server you configured. For our example, we select Entra_ID_SAML.
6. Click Add to add it to the Authentication Servers list.



7. Click Save.
8. Copy the SP metadata URL, then click Done.



9. Open a web browser and go to the SP metadata URL at:
   https://[Host name or Firebox IP address]/auth/saml
   If you configure an Access Portal port other than 443, you must navigate to
   https://<Firebox interface IP address>:<custom port number>/auth/saml
   The configuration instructions page appears.

   Several Firebox features use SSL/TLS for secure communication. For more information, go to Shared Settings and Policy.

10. Make sure you have this SP information from Option 2. You use this information when you configure Entra ID:
    • SAML Entity ID in this format:
      https://<host name>/auth/saml
    • Assertion Consumer Service (ACS) URL in this format:
      https://<host name>/auth/saml/acs
    • Single Logout Service (SLS) URL in this format:
      https://<host name>/auth/saml/sls
    • Download the X.509 Certificate.

Configure Microsoft Entra ID

To configure Microsoft Entra ID, complete these steps:

1. Create a Microsoft Entra ID group and user.
2. Configure a SAML application.

Create a Microsoft Entra ID Group and User

To create a group in Microsoft Entra ID:

1. Log in to the Azure portal with your Microsoft Azure account credentials.
2. Click Microsoft Entra ID.
3. From the left navigation, click Manage > Groups.
4. Click New Group.
5. From the Group Type drop-down list, select Security.
6. In the Group Name text box, type a descriptive group name. For our example, we type access_portal_group.
7. From the Membership Type drop-down list, select Assigned.



8. Keep the default values for other settings.
9. Click Create.

To create a user in Microsoft Entra ID:

1. Log in to the Azure portal with your Microsoft Azure account credentials.
2. Click Microsoft Entra ID.
3. From the left navigation, click Manage > Users.
4. Click New User > Create new user.
5. From the Basics tab, provide the user information.



6. From the Assignments tab, click Add Group to assign the user to the group you created.



7. Click Review + Create.
8. Click Create.

Configure a SAML Application

To configure a SAML application in Microsoft Entra ID:

1. Log in to the Azure portal with your Microsoft Azure account credentials.
2. Click Microsoft Entra ID.
3. From the left navigation, click Manage > Enterprise applications.
4. Click New Application.
5. Click Create your own application.
6. In the What's the name of your app? text box, type a descriptive name. For our example, we type Firebox Access Portal SAML.
7. For What are you looking to do with your application?, select Integrate any other application you don't find in the gallery (Non-gallery).



8. Click Create.
9. From the left navigation, click Manage > User and Groups.
10. Click Add user/group.
11. From Users and groups, click None Selected to assign users and groups to this application. For our example, we select the group we created.



12. Click Select.
13. Click Assign.



14. From the left navigation, click Single sign-on.
15. For Select a single sign-on method, select SAML.



16. From Basic SAML Configuration, click Edit.
17. Specify these settings:

Identifier (Entity ID)

https://<your host name>/auth/saml

The name on the WatchGuard Firebox SAML 2.0 Configuration page is SAML Entity ID.

Reply URL (Assertion Consumer Service URL)

https://<your host name>/auth/saml/acs

The name on the WatchGuard Firebox SAML 2.0 Configuration page is Assertion Consumer Service (ACS) URL.

Logout Url (Optional)

https://<your host name>/auth/saml/sls

The name on the WatchGuard Firebox SAML 2.0 Configuration page is Single Logout Service (SLS) URL.



18. Click Save, then close the Basic SAML Configuration page.
19. In theTest Single sign-on dialog box, click No, I'll test later.
20. In the Attributes & Claims section, click Edit.



21. Click Add a group claim to configure the group authentication for the Access Portal.
22. For Which groups associated with the user should be returned in the claim?, select Groups assigned to the application.
23. From the Source attribute drop-down list, select Cloud-only group display names.
24. Click to expand the Advanced options, then select Customize the name of the group claim.
25. In the Name (required) text box, type memberOf.



26. Click Save, then click to close the Attributes & Claims page.
27. For the SAML Certificates section, copy the App Federation Metadata Url. You need this URL to complete the SAML authentication server configuration on the Firebox.
28. From the left navigation, click Security > Token Encryption.
29. Click Import Certificate, then select the certificate you downloaded in the previous section.
30. Click , and click Activate Token Encryption Certificate.
31. From the Activate Token Encryption Certificate dialog box, click Yes.

Complete SAML Authentication Server Setup

From Fireware Web UI:

1. Log in to Fireware Web UI:
   https://<your Firebox IP address>:8080
2. From the left navigation, select Authentication > Servers.
3. Select SAML.
4. In the IdP Metadata URL text box, paste the value of the App Federation Metadata Url you copied from the previous section.



5. Click Save.

Complete Firebox Access Portal Setup

From Fireware Web UI:

1. Log in to Fireware Web UI.
2. From the navigation, select Subscription Services > Access Portal.
   The Access Portal page appears with the Applications tab selected by default.
3. If you do not have any applications in the Access Portal, follow steps 4-7 to add a web application to the Access Portal. To learn how to add other applications to Access Portal, go to Configure the Access Portal.
4. Click the Add drop-down list and select Web Application.
5. In the Name text box, type a description name.
6. In the URL text box, type a URL address.



7. Click OK.
8. Click Save.



For the remainder of this section, we include the steps to configure group or user authentication. If you allow all applications to be available to all users and groups that authenticate with the Access Portal, go to the test section.

9. From the left navigation, select Authentication > Users and Groups.
10. Click Add.
    The Add User or Group page appears.

You can add a user for user authentication or a group for group authentication. In our example, we add a group for group authentication. If you want to add a user, the user name must be the same as the user name in Microsoft Entra ID.

11. For Type, select Group.
12. In the Name text box, type a name for the group. The group name must be the same as the group name you create and assign to the SAML application in Microsoft Entra ID.
13. From the Authentication Server drop-down list, select the authentication server where the user or group is a member.
    



14. Click OK.
15. Click Save.
16. From the left navigation, select Subscription Services > Access Portal, then select the User Connection Settings tab.
17. In the User Access section, select Specify the applications available to each user and group, then click Add.
    The Add User or Group page opens.
18. From the Authentication Server drop-down list, select the authentication server.
19. From the Type drop-down list, select Group.
20. In the Name text box, type the group name. The group name must be the same as the group you created.
21. Select the applications that are available to this group.



22. Click OK.
23. Click Save.

Test the Integration

To test the integration of Entra ID SAML authentication with the Access Portal:

1. From a web browser, go to the Access Portal URL at:
   https://<Host Name or IP address>
   The log in page appears with the SAML portal you configured as an option.



2. To log in, click the name of the SAML portal. In this example, we click Entra_ID_SAML.
3. On the Microsoft Sign in page, type the Microsoft Entra ID user name, and click Next.



4. Type the Microsoft Entra ID user password, and click Sign In.



5. Click Yes to stay signed in.



After a successful authentication, a user can access the resources.