Configuring a Centralized Identity Provider

In R82 and higher, you can centrally define one or more Identity Providers (IdP), such as Microsoft Entra ID and Okta within Check Point Portal. These IdP configurations can then be reused across multiple Security Gateways using SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. that have the Identity AwarenessClosed Software Blade on a Check Point Firewall that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA. Blade enabled.

How Centralized IdP Works

  • You configure your IdP once in the Check Point Portal.

  • The IdP is then available as a read-only object in SmartConsole.

  • Security Gateways use this central IdP for user authentication and group membership, enabling Identity Awareness features such as user-based Access Roles and policies.

This example uses Microsoft Entra ID but applies to any IdP supported by the Check Point Portal.

  1. A user defined in Microsoft Entra ID attempts to access Amazon Web Services.

    Note - If you have more than one IdP configured, the user is redirected to the Captive PortalClosed A Check Point Identity Awareness web portal, to which users connect with their web browser to log in and authenticate, when using Browser-Based Authentication. to select an IdP.

  2. Upon successful authentication through the IdP, the user is granted access to Amazon based on your predefined ruleClosed Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session..

Limitation

Prerequisites

  • Access to one of these supported cloud platforms.

  • An app on your chosen platform with permissions to create groups and assign users.

  • SmartConsole is connected to the Check Point Portal.

  • Login credentials for Check Point Portal and the IdP.

Supported IdPs

  • Microsoft ADFS

  • Microsoft Entra ID

  • Okta

  • OneLogin

  • Ping Identity

  • Google Workspace

  • Generic SAML Server

Important - Only the EU, US, India and Australia regions are supported in Identity and Trust configurations.

How to Configure a Centralized Identity Provider

Before you begin, log in to SmartConsole, the Check Point Portal, and your IdP.

Check Point supports multiple Identity Providers. Refer to SSO Authentication Setup with Identity Provider for detailed procedures.

  1. Open SmartConsole and log in to your Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server..

  2. Select Integration & Services > click Get Started.

  3. In the Instructions window How to connect to the Check Point Portal (formerly known as Infinity Portal), click Get Token.

  4. Navigate to the Check Point Portal to authenticate and select an account, agree to share your Security Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. data with the Check Point Portal, and copy the token.

  5. Return to SmartConsole, paste the token into the SmartConsole's instructions window and click Connect.

  6. Wait for the Security Management Server to connect to the Check Point Portal.

  7. In the Check Point Portal, make sure your Security Management Server is connected. The Connect status shows Active, as in this example:


  8. Follow the steps for adding an IdP, see SSO Authentication Setup with Identity Provider.

  9. Test connectivity, confirm the Identity Provider, run the connectivity test, and close.

  10. The Identity Provider defined on the Check Point Portal is now available as a read-only object in SmartConsole.

  1. In SmartConsole, open the gateway object (the one that you want to connect to the IdP) and enable the Identity Awareness Blade.

  2. In the First Time Configuration Wizard, select Browser-Based Authentication > Next.

  3. Select "I do not wish to configure an Active Directory at this time" and click Next > (again) Next > Finish.

  4. In the navigation tree, select the Identity Awareness property and open the Browser-Based Authentication settings.

  5. Below Authentication Settings, select Edit.

  6. For the Authentication Method, select Identity Provider as the authentication method, and then select the IdP that you configured in the Check Point Portal. In this example, "Central IdP".

  7. Click OK, and then OK again to save the settings.

  8. In the Security Policies view, create a rule for testing purposes.

    1. Name - Give the rule a name, for example, "Central_IdP".

    2. Source - Add an Access Role that contains the user group assigned to your central IdP (such as Azure). The Access RoleClosed Access Role objects let you configure network access according to: Networks, Users and user groups, Computers and computer groups, Remote Access Clients. After you activate the Identity Awareness Software Blade, you can create Access Role objects and use them in the Source and Destination columns of Access Control Policy rules. gets its groups and users in those groups from those defined on the IdP. To create an Access Role, see Creating Access Roles.

    3. Destination - For the Destination, select *Any.

    4. Services & Applications - Select the applicable applications and sites.

    5. Action - In the Action Settings window, the Action is Accept.
      Also, make sure to select the checkbox Enable Identity Captive Portal.

    6. Track - Track matches on the rule with the Log.

  9. Publish the session changes and click Install Policy > Install.