Cisco ASA 5505 - Manual (Page 1605)

74-19
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 74 Configuring Clientless SSL VPN
Using Single Sign-on with Clientless SSL VPN
Configuring the SAML POST SSO Server
Use the SAML server documentation provided by the server software vendor to configure the SAML
server in Relying Party mode.The following steps list the specific parameters required to configure the
SAML Server for Browser Post Profile:
Detailed Steps
Step 1 Configure the SAML server parameters to represent the asserting party (the ASA):
• Recipient consumer URL (same as the assertion consumer URL configured on the ASA)
• Issuer ID, a string, usually the hostname of appliance
• Profile type -Browser Post Profile
Step 2 Configure certificates.
Step 3 Specify that asserting party assertions must be signed.
Step 4 Select how the SAML server identifies the user:
• Subject Name Type is DN
Step 8 (Optional)
max-retry-attempts
Example:
hostname(config-webvpn-sso-saml)# max-retry-attempts
4
hostname(config-webvpn-sso-saml)#
Configures the number of times the ASA retries a
failed SSO authentication attempt before the
authentication times out.
Sets the number of retries to 4. The default is 3 retry
attempts, and the possible range is 1 to 5 attempts.
Step 9 webvpn Switches to webvpn configuration mode.
Step 10 group-policy-webvpn
username-webvpn
If assigning an SSO server to a group policy.
If assigning an SSO server to a user policy.
Step 11 sso-server value
Example:
hostname(config)# username Anyuser attributes
hostname(config-username)# webvpn
hostname(config-username-webvpn)# sso-server value
sample
hostname(config-username-webvpn)#
Specifies SSO authentication for either a group or a
user.
Assigns the SSO server named Example to the user
named Anyuser.
Step 12 test sso-server
Example:
hostname# test sso-server Example username Anyuser
INFO: Attempting authentication request to
sso-server sample for user Anyuser
INFO: STATUS: Success
(Privileged exec mode) Tests the SSO server
configuration.
Tests the SSO server Example using the username
Anyuser.
Command Purpose