Cisco ASA Series User Manual

1-21
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Clientless SSL VPN
Using Single Sign-on with Clientless SSL VPN
Optionally, in addition to these required tasks, you can do the following configuration tasks:
• Configure the authentication request timeout (the request-timeout command)
• Configure the number of authentication request retries (the max-retry-attempts command)
Restrictions
• SAML SSO is supported only for clientless SSL VPN sessions.
• The ASA currently supports only the Browser Post Profile type of SAML SSO Server.
• The SAML Browser Artifact method of exchanging assertions is not supported.
Detailed Steps
This section presents specific steps for configuring the ASA to support SSO authentication with SAML
Post Profile. To configure SSO with SAML-V1.1-POST, perform the following steps:
Command Purpose
Step 1
webvpn
Switches to webvpn configuration mode.
Step 2
sso-server with the type option
Example:
hostname(config)# webvpn
hostname(config-webvpn)# sso-server sample type
SAML-V1.1-post
hostname(config-webvpn-sso-saml)#
Creates an SSO server.
Creates an SSO server named Sample of type
SAML-V1.1-POST.
Step 3
sso saml
Switches to webvpn-sso-saml configuration mode.
Step 4
assertion-consumer-url
Example:
hostname(config-webvpn-sso-saml)#
assertion-consumer-url http://www.example.com/webvpn
hostname(config-webvpn-sso-saml)#
Specifies the authentication URL of the SSO server.
Sends authentication requests to the URL
http://www.Example.com/webvpn.
Step 5
a unique string
Example:
hostname(config-webvpn-sso-saml)# issuer myasa
hostname(config-webvpn-sso-saml)#
Identifies the ASA itself when it generates
assertions. Typically, this issuer name is the
hostname for the ASA.
Step 6
trust-point
hostname(config-webvpn-sso-saml)# trust-point
mytrustpoint
Specifies the identification certificate for signing the
assertion.
Step 7
(Optional)
request-timeout
Example:
hostname(config-webvpn-sso-saml)# request-timeout 8
hostname(config-webvpn-sso-saml)#
Configures the number of seconds before a failed
SSO authentication attempt times out.
Sets the number of seconds before a request times
out to 8. The default number of seconds is 5, and the
possible range is 1 to 30 seconds.

Cisco ASA Series Specifications

General

Model	ASA 5505
Interfaces	Varies by model (Fast Ethernet, Gigabit Ethernet, 10 Gigabit Ethernet, etc.)
High Availability	Active/Standby or Active/Active (varies by model)
Power Supply	Varies by model
Form Factor	Varies by model
Operating System	Cisco ASA Software
IPsec VPN	Supported
SSL VPN	Supported
IPS Throughput	Varies by model