Microsoft Entra ID (formerly Azure AD)

1. Log in to your Azure portal.

2. In the home directory, click on the hamburger button to show the portal menu.

3. Got to Microsoft Entra ID > Enterprise applications> All applications.

   Important - Check Point does not support the preconfigured Infinity Portal application in Microsoft Azure Collection of integrated cloud services that developers and IT professionals use to build, deploy, and manage applications through a global network of data centers managed by Microsoft®.. You must create a new application for Infinity Portal in Microsoft Azure as shown in this procedure.

4. Click New application.

   

5. Click Create your own application.

6. In the What’s the name of your app field, enter a name for the application (example: "Infinity Portal") and click Integrate any other application you don’t find in the gallery (Non-gallery).

   

7. Click Create and wait for Azure to add the new application.

1. Click on the Azure portal menu.

2. Click Microsoft Entra ID.

3. Click Groups.

4. Click New group.

   The New Group window opens.

5. Enter a Group name and Group description.

6. Add members to the group.

7. Click Create and wait for Azure to successfully create the group.

1. Open the enterprise application you created for the Infinity Portal.

2. Click Assign users and groups.

3. Click add user/group.

4. Click None Selected.

5. Search for the group you created for Infinity Portal users.

6. Click the group and click Select.

7. Click Assign to assign the group to the application.

8. Open the user group.

9. Copy the group's Object Id.

1. In the Infinity Portal tenant that administrators should access through Azure SSO Single Sign-On (SSO) - A session/user authentication process that permits a user to enter one name and password in order to access multiple applications., click > User Groups.

2. Click New.

   The ADD USER GROUP window opens.

3. Enter a Name for the group.

4. Enter a Description for the group.

5. In the IDP Id field, paste the Object ID of the group from the Azure portal.

6. Assign a role to the group. For more information, see User Groups.

7. Click ADD.

1. Select Enable Administrators to log in to the portal using this IdP.

2. Select one of these options:

   • One organizational account - Infinity Portal Administrators can log into this Infinity Portal account with SSO from the Identity Provider. Administrators log in through the Infinity Portal login page.

   • One or more organizational accounts - Infinity Portal Administrators can log in with SSO from the Identity Provider for multiple Infinity Portal accounts. Administrators log in through the URL that shows in the box.

3. Do one of these actions:

   • Continue to the Service(s) Integration section.

   • Click Next / Apply to complete the Integration Type configuration.

1. In the Service(s) Integration section, select one of these options:

   • No Services - There is no SSO authentication from the Identity Provider for end users of Check Point services. This is the default configuration.

   • All Services - End users can log in with SSO from the Identity Provider for all Check Point services that support SSO.

   • Specific Service(s) - A list of services opens. Select service(s) for which you want end users to log in with SSO from the Identity Provider. Available services:

     • Harmony Connect

     • Quantum Gateways

2. Click Next / Apply to complete the Integration Type configuration.

1. In the Infinity Portal Allow Connectivity page, copy the Entity ID and the Reply URL.

2. In the Azure portal, on the Check Point Infinity Portal application integration page, in the Manage section select Single sign-on.

   

3. On the Select a single sign-on method page, select SAML.

4. On the Set up single sign-on with SAML page, click the pencil icon to edit the settings for Basic SAML Configuration.

5. In the Basic SAML Configuration section, click Edit and do these steps:

   1. In the Identifier text box, paste the copied entity ID.

   2. In the Reply URL text box, paste the previously-copied Reply URL.

   3. In the Sign on URL text box, paste the previously-copied Reply URL as well.

6. In the User Attributes & Claims section, click Edit and do these steps:
   

   1. Edit User Attributes & Claims and click Add a group claim.

   2. In Group Claims, select All Groups. For the Source attribute, select Group ID.

   3. In Advanced Options, select Customize the name of the group claim.

   4. In the Name (required) field, enter groups.

      Important - Do not use capital letters.

   5. Click Save.

   6. Make sure that these claims are in the User Attributes & Claims list:

      • Claim Name - identity/claims/emailaddress

        Claim Type -User

        Value - user.emailaddress

      • Claim Name - identity/claims/givenname

        Claim Type - User

        Value - user.givenname

      • Claim Name - identity/claims/objectidentifier

        Claim Type - User

        Value - user.objectidentifier

7. If you do not want to configure IdP Initiated Flow, in the Infinity Portal click Next/Apply.

IdP Initiated flow lets you connect directly to Infinity Portal from your Azure portal. To do this, you must create an Infinity Portal app card in your Azure portal. See the Microsoft Entra ID documentation for App integrations.

Step 1: In the Infinity Portal, enable IdP Initiated flow:

In the IdP Integration Allow Connectivity step, select the checkbox Enable IdP initiated flow.

Step 2: Copy the the IdP Settings from the Infinity Portal to the Azure Portal

1. In the Azure portal > Single sign-on tab > Basic SAML Configuration section, click Edit.

2. Copy the Sign on URL from the Infinity Portal to the Sign on URL field in the Azure portal.

3. Copy the Relay State from the Infinity Portal to theRelay State field in the Azure portal.

4. In the Azure portal, click Save.

5. In the Infinity Portal, click Next/Apply.

Select relevant users and groups:

1. In the Azure portal, navigate to the enterprise application you created and click Users and groups.

2. Click Add user/group.

   

3. In Users and groups, select the required users or groups and click Select.

4. Click Assign.

Set up users and groups synchronization:

Set up permissions to allow the selection of users and user groups from your Microsoft Entra ID in the Infinity Portal Policy.

1. In the Azure portal, click App Registration.

2. Create a new App Registration.

3. Click API permissions.

   

4. In Configured permissions, click Add a permission.

   The Request API permissions window opens.

   

5. In Microsoft APIs, click Microsoft Graph and select Application permissions.

6. In Select permissions, in the search field, enter Group and select Group.Read.All and click Add permissions.

   

7. In Select permissions, in the search field, enter User and select User.Read.All and click Add permissions.

   

8. Optional - Set up synchronization for device information. In Select permissions, in the search field, enter Device and select Device.Read.All and click Add permissions.

   

9. In Configured permissions, click Grant admin consent for <application name>.

   The Status changes accordingly.

   

10. Create an authentication secret key:

    1. In the Azure portal, open your app and click Certificates & secrets.

       

    2. Under Client secrets, click New client secret.

    3. In the Description field, enter a description for the client's secret.

    4. Select an expiration date and click Add.

       

    5. From the Value field, copy the value of this new client secret.

       Use this value in the next configuration step.

       Note - You cannot retrieve this secret value after you close the window.

Configure the Infinity Portal IdP:

1. In the Azure Portal, open your app. Click Overview and select Essentials.

2. Copy the values of the Application (client) ID and Directory (tenant) ID.

3. In the Identity Provider wizard, paste the values of Application (client) ID, Directory (tenant) ID, and Client Secret created in the previous step and click Next.

   

4. To test the users and group synchronization between the Infinity Portal and Identity Provider, click Test Connectivity.

   If the test is unsuccessful, repeat the Set Directory Integration step to configure the user and group synchronization parameters.

5. Click Next.

   Check Point validates access with the API key.

Prerequisites:

• Before you start the IdP integration, in the Infinity Portal create a user group with an Admin global role. See Users.

• Administrator permissions for the IdP.

• Must have existing Active Directory Microsoft® directory information service. Stores data about user, computer, and service identities for authentication and access. Acronym: AD. and a premium P2 Azure subscription

Step 1 - Configure the Directory Integration in the Infinity Portal:

1. In the Infinity Portal go to > Identity & Access > and below Identity Providers click the plus icon.

2. In the Set Directory Integration step, select Automatic Sync SCIM.

   

3. Copy and save the SCIM API Token and URL.

4. Click Next.

5. To save, click Submit.

Step 2 - Configure the Application Integration in the Microsoft Entra ID Portal:

1. In your Microsoft Azure account, navigate to Microsoft Entra ID.

2. From the left toolbar click Enterprise Applications.

   The Enterprise Applications page opens to the Manage > All applications tab.

3. In the table, open the enterprise application you created for the Infinity Portal.

4. From the left toolbar > Manage section, click Provisioning.

   The Provisioning page opens to the Overview tab.

5. From the top toolbar, click Edit provisioning.

   A new page opens.

6. In the Admin Credentials section:

   1. In the Tenant URL field, enter the URL from the Infinity Portal's Set Directory Integration step.

   2. In the Secret Token field, enter the SCIM API Token from the Infinity Portal's Set Directory Integration step.

   3. Click Test Connection.

7. Click Save.

8. In the Mappings section, click Provision Microsoft Entra ID Directory Users.

   The Attribute Mapping page opens.

9. On the Attribute Mapping page:

   1. In the Target Object Actions section, make sure these checkboxes are selected: Create, Update, Delete.

   2. In the Attribute Mappings table, find the row with 'externalId' as the value in the customappsso Attribute column and click Edit.

      The Edit Attribute page opens.

   3. In the Source attribute field, select objectId.

   4. Click OK.

      The Edit Attribute window closes.

      The Attribute Mapping window opens.

   5. Click Save.

      The Save changes confirmation window opens.

   6. In the confirmation window, click Yes.

10. From the top navigation toolbar, click [NAME OF APPLICATION]| Provisioning.

11. Add Users/Groups as necessary.

12. Click Start provisioning.