This article provides step-by-step instructions to configure SAML based user authentication between Microsoft Azure Entra ID and Juniper SRX acting as a SAML Service Provider for Juniper Secure Connect Remote Access VPN.

The SRX acts as the SAML Service Provider (SP). Azure Entra ID acts as the Identity Provider (IdP). When a user connects using Juniper Secure Connect, the SRX redirects authentication to Azure. Upon successful authentication, Azure sends a SAML assertion back to the SRX which validates it and establishes the VPN tunnel.

SAML Authentication Flow

1. Juniper Secure Connect sends a connection request to the SRX specifying a FQDN/IP-address and access-profile name. Example:
2. The SRX checks the access profile and selects the IdP based on the user domain. If the domain is not explicitly configured, the IdP under the any keyword is used as the fallback.
3. The SRX sends a SAML AuthnRequest to Juniper Secure Connect.
4. Juniper Secure Connect launches a web browser and redirects the user to the Azure SSO URL after user enter its username provided by Azure. E.g [email protected]
5. Azure Entra ID authenticates the user (with optional MFA via Conditional Access).
6. Azure sends the SAML assertion back to the SRX ACS URL via HTTP POST.
7. The browser relays the assertion to the SRX firewall.
8. The SRX receives and validates the assertion — verifying signature, audience, validity window, and extracting user attributes.
9. When the assertion is valid, the SRX completes authentication and establishes the IPsec VPN tunnel.

Prerequisites

• Microsoft Azure Entra ID tenant with an active user account
• Juniper SRX Series or vSRX with SAML support (Supported from Junos version 24.4R1)
• A CA-signed local certificate on the SRX for IKE authentication
• A CA-signed local certificate(Same certificate used in point 3) for the SAML SP profile (sp-certificate)
• Juniper Secure Connect client installed on the end-user Windows device.
• SRX must be able to reach Azure SSO and logout URLs from its external interface.

CAUTION: Self-signed certificates are NOT supported for SAML-based authentication with Juniper Secure Connect. Use a certificate signed by a public CA, enterprise CA, or Let's Encrypt for both IKE and the SP certificate.

Part 1: Microsoft Azure Entra ID Configuration

Step 1: Create the Enterprise Application

1. Sign in to the Azure portal (portal.azure.com)
2. Navigate to: Azure Entra ID > Enterprise Applications > New Application
3. Select Create your own application
4. Enter a recognizable name (e.g., Juniper-SRX-VPN)
5. Select Integrate any other application you don't find in the gallery
6. Click Create

Step 2: Assign Users to the Application

1. Open the application > Users and Groups
2. Click Add user/group and assign the required users or groups
3. Open Properties and confirm Enable for users to sign-in is set to Yes

Step 3: Configure SAML Single Sign-On

1. Open the application > Single Sign-On
2. Select SAML as the sign-on method
3. In Basic SAML Configuration, configure:

CAUTION: Entity IDs and domain names are case-sensitive in SAML. Ensure the Entity ID in Azure exactly matches the entity-id configured on the SRX service-provider profile.

 

Step 4: Configure Attributes and Claims

This is the most critical step and the most common source of authentication failures. The SRX extracts the username from a named attribute in the SAML assertion. The claim name in Azure must exactly match the attribute name configured in the SRX attribute-mapping.

Rules for configuring claims in Azure:

• Do NOT set a Namespace for user-defined claims — leave the Namespace field completely blank.
• Use a short simple claim name (e.g., mail) — Junos does not accept full URI strings as attribute names in the CLI.
• For cloud-only accounts (e.g., *.onmicrosoft.com tenants), user.mail may be empty — use user.userprincipalname as the source attribute instead as it is always populated.
• The claim name configured in Azure will appear in the SAML assertion XML as <Attribute Name="mail"> — this is exactly what the SRX looks for.

Recommended Attributes and Claims configuration:

IMPORTANT: If you configure the claim with a Namespace or use the full URI format (e.g., http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress), the SRX will NOT match it and authentication will fail with the Assertion attributes missing counter incrementing on every login attempt.

 

Step 5: Download Certificate and Note URLs

1. In SAML Certificates, download the Certificate (Base64)
2. From the Set up [YourApp] section, record:

• Login URL — used as single-signon-url on SRX
• Logout URL — used as single-logout-url on SRX
• Azure AD Identifier — used as entity-id on SRX

NOTE: The Microsoft Entra Identifier shown in the portal may differ from the entityID value inside the Federation Metadata XML. Always verify by checking the XML file directly before configuring the SRX.

Part 2: Juniper SRX Configuration

Step 1: Import the Azure SAML Signing Certificate

# Transfer Base64 certificate to SRX in /var/tmp/ directory.

# Configure the CA profile
set security pki ca-profile AZURE-CA ca-identity AZURE-CA
set security pki ca-profile AZURE-CA revocation-check disable

# Load the certificate
request security pki ca-certificate load ca-profile AZURE-CA filename /var/tmp/azure-saml.cer

# Verify
show security pki ca-certificate ca-profile AZURE-CA detail

Step 2: Configure the SAML Service Provider (SP)

The sp-certificate assignment is mandatory. Without it, Junos cannot initialize the SAML provider object and all authentication attempts will fail silently.

set access saml service-provider <SP-NAME> entity-id https://<your-srx-fqdn>
set access saml service-provider <SP-NAME> assertion-waittime 60 <max-time 600 seconds>
set access saml service-provider <SP-NAME> sp-certificate <local-cert-id> >>> CA signed local-certificate

IMPORTANT: If sp-certificate is not assigned, the SRX logs will show saml_auth_create_saml_provider: 414 cert id is not present and every SAML login will fail even after the user successfully authenticates with Azure.

 

Step 3: Configure the SAML Identity Provider (IdP)

set access saml identity-provider AZURE-IDP settings entity-id https://sts.windows.net/<tenant-id>/
set access saml identity-provider AZURE-IDP settings single-signon-url https://login.microsoftonline.com/<tenant-id>/saml2
set access saml identity-provider AZURE-IDP settings single-logout-url https://login.microsoftonline.com/<tenant-id>/saml2
set access saml identity-provider AZURE-IDP settings idp-certificate AZURE-CA
set access saml identity-provider AZURE-IDP attribute-mapping username mail mandatory
set access saml identity-provider AZURE-IDP attribute-mapping firstname givenname optional
set access saml identity-provider AZURE-IDP attribute-mapping lastname surname optional

Step 4: Configure the Access Profile

# Authentication method
set access profile JSC-ACCESS authentication-order saml

# Link SP and IdP
set access profile JSC-ACCESS saml service-provider <SP-NAME>
set access profile JSC-ACCESS saml identity-provider any idp-name AZURE-IDP

# Address pool
set access profile JSC-ACCESS address-assignment pool JSC-POOL
set access address-assignment pool JSC-POOL family inet network 192.168.192.0/24
set access address-assignment pool JSC-POOL family inet range JSC-RANGE low 192.168.192.10
set access address-assignment pool JSC-POOL family inet range JSC-RANGE high 192.168.192.100
set access address-assignment pool JSC-POOL family inet xauth-attributes primary-dns 8.8.8.8/32

# Firewall authentication
set access firewall-authentication web-authentication default-profile JSC-ACCESS

NOTE: Using any as the identity-provider name is a wildcard matching all user domains. For domain-specific routing, replace any with the actual domain name (e.g., example.com).

Step 5: Configure IKE

# IKE Proposal
set security ike proposal JSC-IKE-PRO authentication-method rsa-signatures
set security ike proposal JSC-IKE-PRO dh-group group19
set security ike proposal JSC-IKE-PRO authentication-algorithm sha-256
set security ike proposal JSC-IKE-PRO encryption-algorithm aes-256-cbc

# IKE Policy
set security ike policy JSC-IKE-POL proposals JSC-IKE-PRO
set security ike policy JSC-IKE-POL certificate local-certificate <ike-cert-id> >>> CA signed local-certificate

# IKE Gateway
set security ike gateway JSC-GW ike-policy JSC-IKE-POL
set security ike gateway JSC-GW dynamic user-at-hostname "[email protected]"
set security ike gateway JSC-GW dynamic ike-user-type shared-ike-id
set security ike gateway JSC-GW dead-peer-detection optimized
set security ike gateway JSC-GW dead-peer-detection interval 10
set security ike gateway JSC-GW dead-peer-detection threshold 5
set security ike gateway JSC-GW local-identity inet 10.10.10.1
set security ike gateway JSC-GW external-interface ge-0/0/0
set security ike gateway JSC-GW local-address 10.1.1.4
set security ike gateway JSC-GW aaa access-profile JSC-ACCESS
set security ike gateway JSC-GW version v2-only
set security ike gateway JSC-GW tcp-encap-profile JSC-ENCAP

IMPORTANT: If the SRX is hosted behind any NAT device, add the public IP as local-identity to prevent IKE gateway lookup failures: set security ike gateway JSC-GW local-identity inet <public-ip>

Step 6: Configure IPsec

set security ipsec proposal JSC-IPSEC-PRO protocol esp
set security ipsec proposal JSC-IPSEC-PRO encryption-algorithm aes-256-gcm
set security ipsec policy JSC-IPSEC-POL proposals JSC-IPSEC-PRO
set security ipsec policy JSC-IPSEC-POL perfect-forward-secrecy keys group19
set security ipsec vpn JSC-VPN bind-interface st0.0
set security ipsec vpn JSC-VPN df-bit clear
set security ipsec vpn JSC-VPN ike gateway JSC-GW
set security ipsec vpn JSC-VPN ike ipsec-policy JSC-IPSEC-POL

Step 7: Configure Remote Access Profile

set security remote-access profile jsc-saml ipsec-vpn JSC-VPN
set security remote-access profile jsc-saml access-profile JSC-ACCESS
set security remote-access profile jsc-saml client-config JSC-CLIENT

set security remote-access client-config JSC-CLIENT connection-mode manual
set security remote-access client-config JSC-CLIENT dead-peer-detection interval 60
set security remote-access client-config JSC-CLIENT dead-peer-detection threshold 5
set security remote-access client-config JSC-CLIENT no-eap-tls

Step 8: Configure TCP Encapsulation and SSL

set services ssl termination profile JSC-SSL-PRO server-certificate <ssl-cert-id> >>> CA signed local-certificate
set security tcp-encap profile JSC-ENCAP ssl-profile JSC-SSL-PRO
set security tcp-encap profile JSC-ENCAP log
set security ike gateway JSC-GW tcp-encap-profile JSC-ENCAP


# SAML statistics — Assertion attributes missing must be 0
show network-access aaa statistics saml detail

# SAML assertion cache — shows authenticated users
show network-access aaa saml assertion-cache

# Active subscribers
show network-access aaa subscribers

# IKE and IPsec tunnels
show security ike security-associations
show security ipsec security-associations
show security ike active-peer