SAML Authentication on multiple Service Principals (SPs) with only one login

Question

Hi. I have two firewalls acting as proxies. Each firewall has different resources behind them. This firewalls are configured as SAML SP's and Azure as SAML IdP to get authentication with Microsoft credentials before access any resource behind the firewalls.

I configured only one SAML Enterprise application on Azure with two identifiers.

Now, if I try to access one of the firewalls, I get the microsoft login page asking for credentials, but if I try to access the second firewall, I will be asked for credentials again.

I want to access login just one time and get access to both firewalls.

I think somehow both firewalls are not sharing the SAML assertions, even though I have both configured under the same enterprise application.

Any advice?

Thank you.

Answer 1

@Juan Manuel Castro I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: I have two firewalls acting as proxies. Each firewall has different resources behind them. This firewalls are configured as SAML SP's and Azure as SAML IdP to get authentication with Microsoft credentials before access any resource behind the firewalls.

Now, if I try to access one of the firewalls, I get the microsoft login page asking for credentials, but if I try to access the second firewall, I will be asked for credentials again.

I want to access login just one time and get access to both firewalls.

I think somehow both firewalls are not sharing the SAML assertions, even though I have both configured under the same enterprise application.

Any advice?

Solution: Resolved by @Juan Manuel Castro found that the issue was in the application, because it uses an embedded browser. I change this to use an external browser (of the device) and the issue was solved.

Also, I am controlling the time the user is connected using SAML by change the Conditional access section of the Enterprise Application.

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.