Prerequisites for SAML Authentication

To configure the integration of a Security Assertion Markup Language (SAML) identity provider (IdP) with Cisco Secure Access, you must meet certain requirements.

Secure Access Service Provider Metadata

  • Secure Access Entity ID—saml.fg.id.sse.cisco.com
  • Secure Access Entity URL—fg.id.sse.cisco.com/gw/auth/acs/response

Requirements

  • Full Admin user role. For more information, see Manage Accounts.
  • Provision users and groups from your organization in Secure Access. The users and groups must match the identities obtained from SAML. For more information, see Manage Users and Groups.
  • Download your IdP SAML metadata file in XML format.
  • The SAML metadata must have a signing key.
  • Configure SAML with an identity provider (IdP) that supports SAML 2.0 POST profiles.
  • Ensure that traffic to your IdP URL is bypassed on the SWG to avoid an authentication loop. For more information, see Manage Domains.
  • Enable cookies for your browser. For more information, see your browser's documentation.
  • You must install the Cisco Secure Access root certificate on all client machines egressing from networks or network tunnels where SAML is enabled. For more information, see Manage Certificates.
  • If you use AD FS for SAML, we recommend that you bypass web traffic to the id.sse.cisco.com domain on the Secure Access secure web gateway (SWG). For other IdPs, send id.sse.cisco.com requests to the SWG, not directly to the internet. For more information about bypassing domains and Secure Access Web security, see Manage Domains.

Enable SAML and HTTPS Inspection in the Web Profile

  • To obtain the user identity of a device through SAML, enable SAML in the Secure Access Web profile. For more information, see Manage Web Profiles.
  • Enable HTTPS Inspection in the Secure Access Web profile. Secure Access must inspect the Cookie HTTP header to read the SAML cookie. The SAML cookie acts as the authentication token or surrogate. For more information, see Manage Web Profiles.

Configure Integrations with SAML Identity Providers < Prerequisites for SAML Authentication > Configure Azure AD for SAML