Microsoft Entra ID SAML Authentication with WatchGuard Firebox Authentication Portal

Deployment Overview

The SAML authentication server in Fireware 12.11 or higher can integrate with several services. After you configure the SAML authentication server on the Firebox, you can use it to integrate with the Authentication Portal.

This integration guide describes how to set up SAML authentication for the Authentication Portal so that users must authenticate when they connect to the Firebox over port 4100.

For information about the integration end result, go to the Test the Integration section.

Contents

• Microsoft Entra ID SAML Authentication with WatchGuard Firebox Authentication Portal
• • Deployment Overview
  • Contents
  • Integration Summary
  • Test Topology
  • Enable the Firebox SAML Authentication Server
  • Configure Firewall Policies
  • Configure Microsoft Entra ID
  • • Create a Microsoft Entra ID Group and User
    • Configure a SAML Application
  • Complete Firebox Setup
  • Test the Integration

Test Topology

Microsoft Entra ID can use SAML authentication to communicate with various cloud-based services and service providers. This integration guide demonstrates how to use Microsoft Entra ID to communicate with a WatchGuard Firebox over a public Internet connection.

Enable the Firebox SAML Authentication Server

To enable the Firebox SAML authentication server:

1. Log in to Fireware Web UI at:
   https://<your Firebox IP address>:8080

2. From the left navigation, select Authentication > Servers.



3. Select SAML.
   The SAML settings page opens.

4. Select Enable SAML.
5. In the IdP Name text box, type a name for the identity provider. In our example, we type Entra_ID_SAML.
6. In the Host Name text box, type an FQDN that resolves to the Firebox external interface.
7. Keep the IdP Metadata URL text box blank for now, we add the IdP settings later.



8. Click Save.

Configure Firewall Policies

The Authentication Portal is a page that the Firebox hosts. For the Firebox to allow connections to the Authentication Portal, you must add a WG-Auth firewall policy to the Firebox configuration. A WG-Auth policy allows TCP traffic on port 4100.

To configure the WG-Auth policy:

1. Log in to Fireware Web UI at:
   https://<your Firebox IP address>:8080
2. Select Firewall > Firewall Policies.
3. Click Add Policy.
   The Select a Policy Type page opens.

4. From the Packet Filter drop-down list, select WG-Auth.
5. Click Add Policy.
6. From the Settings tab, in the From and To sections, specify the source and destination of connections the policy applies to. You must also add the Firebox alias in the To section. For more information, go to Set Access Rules for a Policy.
7. (Optional) Check Send a log message.

8. Click Save.
9. Open a web browser and go to the SP Metadata URL at:
   https://[Host name or Firebox IP address]:4100/auth/saml
10. Make sure you have this SP information from Option 2.You use this information when you configure Entra ID:
    • AML Entity ID in this format:
      https://<host name>:4100/auth/saml
    • Assertion Consumer Service (ACS) URL in this format:
      https://<host name>:4100/auth/saml/acs
    • Single Logout Service (SLS) URL in this format:
      https://<host name>:4100/auth/saml/sls
    • Download the X.509 Certificate.

Configure Microsoft Entra ID

To configure Microsoft Entra ID, complete these steps:

1. Create a Microsoft Entra ID group and user.
2. Configure a SAML application.

Create a Microsoft Entra ID Group and User

To create a group in Entra ID:

1. Log in to the Azure portal with your Microsoft Azure account credentials.
2. Click Microsoft Entra ID.
3. From the left navigation, click Manage > Groups.
4. Click New Group.
5. From the Group Type drop-down list, select Security.
6. In the Group Name text box, type a descriptive group name. For our example, we type authentication_portal_group.
7. From the Membership Type drop-down list, select Assigned.



8. Keep the default values for other settings.
9. Click Create.

To create a user in Entra ID:

1. Log in to the Azure portal with your Microsoft Azure account credentials.
2. Click Microsoft Entra ID.
3. From the left navigation, click Manage > Users.
4. Click New User > Create new user.
5. Under the Basics tab, provide the user information.



6. From the Properties tab, type the First name, Last name, and Email.
7. Select Usage location.
8. From the Assignments tab, click Add group to assign the user to the group you created.



9. Click Review + create.
10. Click Create.

Configure a SAML Application

To configure a SAML application in Microsoft Entra ID:

1. Log in to the Azure portal with your Microsoft Azure account credentials.
2. Click Microsoft Entra ID.
3. From the left navigation, click Manage > Enterprise applications.
4. Click New Application.
5. Click Create your own application.
6. In the What's the name of your app? text box, type a descriptive name. For our example, we type Firebox Authentication Portal SAML.
7. For What are you looking to do with your application?, select Integrate any other application you don't find in the gallery (Non-gallery).



8. Click Create.
9. From the left navigation, click Manage > User and Groups.
10. Click Add user/group.
11. For Users and groups, click None Selected to assign users and groups to this application. For our example, we select the group we created.



12. Click Select.
13. Click Assign.



14. From the left navigation, click Single sign-on.
15. For Select a single sign-on method, select SAML.



16. For the Basic SAML Configuration, click Edit.
17. Specify these settings:

Identifier (Entity ID)

https://<your host name>:4100/auth/saml

The name on the WatchGuard Firebox SAML 2.0 Configuration page is SAML Entity ID.

Reply URL (Assertion Consumer Service URL)

https://<your host name>:4100/auth/saml/acs

The name on the WatchGuard Firebox SAML 2.0 Configuration page is Assertion Consumer Service (ACS) URL.

Logout Url (Optional)

https://<your host name>:4100/auth/saml/sls

The name on the WatchGuard Firebox SAML 2.0 Configuration page is Single Logout Service (SLS) URL.



18. Click Save, then click to close the Basic SAML Configuration page.
19. For the Test Single sign-on dialog box, click No, I'll test later.
20. For the Attributes & Claims section, click Edit.



21. Click Add a group claim to configure the group authentication for the Authentication Portal.
22. For Which groups associated with the user should be returned in the claim?, select Groups assigned to the application.
23. From the Source attribute drop-down list, select Cloud-only group display names.
24. Click to expand the Advanced options, then select Customize the name of the group claim.
25. In the Name (required) text box, type memberOf.



26. Click Save, then click to close the Attributes & Claims page.
27. For the SAML Certificates section, copy the App Federation Metadata Url. You use this URL to complete the SAML authentication server configuration on Firebox.
28. From the left navigation, click Security > Token Encryption.
29. Click Import Certificate, then select the certificate you downloaded in the previous section.
30. Click then click Activate Token Encryption Certificate.
31. From the Activate token encryption certificate dialog box, click Yes.

Complete Firebox Setup

From Fireware Web UI:

1. Log in to Fireware Web UI:
   https://<your Firebox IP address>:8080
2. From the left navigation, select Authentication > Servers.
3. Select SAML.
4. In the IdP Metadata URL text box, paste the value of the App Federation Metadata Url you copied from the previous section.



5. Click Save.
6. From the left navigation, select Authentication > Users and Groups.
7. Click Add.
   The Add User or Group page appears.

You can add a user for user authentication or a group for group authentication. In our example, we add a group for group authentication. If you want to add a user, the user name must be the same as the user name in Microsoft Entra ID. Assign the user to the SAML application in Microsoft Entra ID.

8. For Type, select Group.
9. In the Name text box, type a name for the group. The group name must be the same as the group you create and assign to the SAML application in Microsoft Entra ID.
10. From the Authentication Server drop-down list, select the SAML authentication server you created in the previous section.
    



11. Click OK.
12. Click Save.

Test the Integration

To test the integration of Entra ID SAML authentication with the Authentication Portal:

1. Type the URL for the Authentication Portal in this format:
   https://<Firebox host name>:4100
   The login page appears with the name of the SAML authentication server you configured at the top of the page.
   



2. To log in, click the name of the SAML Authentication server. In this example, we click Entra_ID_SAML.
3. On the Microsoft Sign in page, type the Microsoft Entra ID user name, and click Next.



4. Type the Microsoft Entra ID user password, and click Sign In.



5. Click Yes to stay signed in.



Authentication is successful.