ISAC support Windows Hello for Business with SAML authentication

8 min

Initiate a connection from ISAC opens a browser window to complete SAML authentication with the configured identity provider. If Windows Hello for Business is enrolled on the device and the browser is configured for SSO, authentication is successful without password. This is supported on Microsoft Edge (native support), Google Chrome (requires the Microsoft Single Sign On extension), or Mozilla Firefox (requires the Firefox Windows SSO setting enabled).

Workflow

Configure the VPN connection profile in ISAC with WHfB SAML realm on ICS.

Open ISAC and select the configured VPN connection profile.

Click Connect.

Based on configuration on ICS, either a browser window opens or an embedded browser is used to complete SAML authentication with the identity provider. If the Windows Hello session is active and the browser is configured, the VPN connection is established automatically without any password prompt.

Browser Requirements for SAML Authentication

By default, ISAC uses an embedded browser for SAML authentication.

If the administrator has configured ISAC to use an external browser, connect using Microsoft Edge, Google Chrome, or Mozilla Firefox. For Windows Hello for Business SSO to silently complete via the external browser, the following configuration is required:

Browser	SSO Support	Requirement
Microsoft Edge	Native — no extension needed	None. PRT-based SSO is built into Edge on Windows 10 and later.
Google Chrome	Supported via extension	Install the Microsoft Single Sign On extension from the Chrome Web Store.
Mozilla Firefox	Supported via setting	Firefox version 91 or later. Go to about:config and set network.http.windows-sso.enabled to true.

Configuring ICS server on Microsoft Azure

To configure the ICS server, perform the following:

SAML authentication on Azure IDP server

Configuring Single Sign-on Settings

Assigning User to Application

For more information, see Microsoft Azure Active Directory Configuration.

Configuring SAML authentication on ICS server

1. Uploading Metadata

Navigate to System > Configuration > SAML to upload Metadata.

Select New Metadata Provider. Enter a name.

Set Location as Local.

Browse to Upload SAML Metadata XML.

Check the Accept Unsigned Metadata option.

In the Roles field, check the Identity Provider option.

Save Changes.

2. Creating a New Auth Server

Navigate to Authentication >Auth. Servers > SAML Server > New Server. Enter a name.

In the Configuration Mode, check the Metadata option.

In the Service Provider Metatdata Settings, set the Metadata Validity to 365.

Select Save Changes.

3. Create User Realm

Navigate to Users > User Realms >New Realm. Enter a Name.

In the Server section, navigate to Authentication and select SAML as the auth server.

Select Save Changes.

4. Map new realm with a role

Navigate to Users > Role Mapping >New Rule. Enter a Name.

Select an Available Role.

Select Save Changes.

Navigate to Authentication > Sign-In-Policies >New URL.

Provide a Sign-In URL.

Select Available Realm.

Select Save Changes.