Configure SSO JIT Provisioning with ADFS

With JIT provisioning, users log in to ADFS with their ADFS credentials and select to log in to CloudGuard configured as an SSOClosed Single Sign-On (SSO) - A session/user authentication process that permits a user to enter one name and password in order to access multiple applications. application. SAML authenticates the credentials and transfers them to CloudGuard to create users based on their email address and AD group membership that are mapped to the existing CloudGuard roles.

Configuring Active Directory

To map dynamically AD groups to CloudGuard roles, create AD groups with CloudGuard or other relevant prefix (for example, CG-Admins, CG-Users). Add users to these AD groups. Check Point recommends to add a user to only one CloudGuard AD group.

  1. Create an Active Directory security group for JIT provisioning to CloudGuard (for example, CG-jit-auditors) in your domain environment. Add to the group the domain users who have to log into CloudGuard.

  2. Add users to the group.

Configuring ADFS

On the ADFS side, ensure that you have a working ADFS configuration. For this, log into the main page

https://<server.domain.com>/adfs/ls/idpinitiatedsignon.htm

where <server.domain.com> is your ADFS WAP server. If you need a valid SSL certificate, you can get one for free from Let’s Encrypt.

Then you need to add CloudGuard as a Relying Party Trust to be a consumer of the ID provider.

  1. In ADFS, add a new Relying Party Trust with Claims aware option and follow the steps in the Relying Party Trust Wizard.

  2. Copy the Service Provider Metadata XML text and save it. Replace <your-company-name> to match the Account ID string that you configure in step 3(a) below in Configuring CloudGuard. If necessary, update the property values of validUntil and cacheDuration.

    XML Template for Service Provider Metadata:

    Copy 
    <?xml version="1.0"?>
      <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2025-09-03T06:43:37Z" cacheDuration="PT604800S" entityID="https://secure.dome9.com">
        <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
          <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
          <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://secure.dome9.com/sso/saml/<your-company-name>" index="1" />
        </md:SPSSODescriptor>
      </md:EntityDescriptor>

  3. On the Select Data Source page, import data from the Service Provider Metadata XML file created above.

  4. On the Specify Display Name page, in the Display name field, enter CloudGuard.

  5. Click Next on each screen until the end of the Wizard.

  1. From the Actions panel, select Edit Claim Issuance Policy.

  2. Click Add Rule and edit the Get Email rule as the picture shows.

  3. Click OK.

  4. Click Add Rule to create another rule.

  5. Set the rule name to Convert Email to NameID and edit the rule.

  6. Select Transform an Incoming Claim and click Next. Set these fields:

    1. Incoming claim type - E-Mail Address

    2. Outgoing claim type - Name ID.

    3. Outgoing name ID format - Email.

  7. Click OK. You have two rules:

  8. Click Apply.

Configuring CloudGuard

When you continue in CloudGuard, log in with your super user credentials.

  1. In CloudGuard, navigate to the Security & Authentication page in the Settings menu.

  2. In the SSO section, click Edit. The SSO Configuration window opens.

  3. Complete the SSO Configuration form with these details:

    1. Account ID - Use the Account ID from the XML file above.

    2. Issuer - Set to http://<your.server.com>/adfs/services/trust

    3. Idp endpoint url - Set to http://<your.server.com>/adfs/ls

    4. X.509 Certificate - Paste from your PFX file, including the --BEGIN CERTIFICATE-- and ---END CERTIFICATE--- text. This is the certificate from your ADFS web server.

  4. Check Allow for Just-in-time provisioning for the account, and leave Attribute name in SAML for just-in-time role as memberOf.

  5. Click Save.

Testing ADFS Single Sign-On

  1. Log in to the ADFS sign-in page with AD credentials and click Sign in to one of the following sites - CloudGuard or other Display Name.

  2. Click Sign in. This action logs you into CloudGuard as a JIT user, matching the AD group to a role with the same name in CloudGuard.

  3. Check the System Audit Trail to see the JIT event: