Description

This KB explains how Juniper Secure Connect (JSC) integrates with SAML authentication using Keycloak as the Identity Provider (IdP) and an SRX firewall as the Service Provider (SP).

With this setup, VPN users authenticate through a browser-based Single Sign-On (SSO) experience instead of traditional credentials. Once authenticated, the SRX validates the SAML assertion and establishes the VPN tunnel.

This approach improves user experience and centralizes authentication in Keycloak.

Symptoms

You may refer to this KB if you observe any of the following while configuring or using JSC SAML login:

  • JSC does not open a browser for login (still asks for username/password only)
  • Login fails after browser authentication
  • SAML timeout or assertion errors
  • VPN tunnel not establishing after successful login
  • Keycloak login page shows but authentication fails
  • Errors like:
    • AUTHD_SAML_AUTH_FAILED
    • mandatory attribute missing
    • PKID_NO_CA_CERT
    • Invalid requester
  • Users must repeatedly re-enter credentials or cannot log in at all

Solution

1. Ensure Version Compatibility

  • SRX must run Junos 24.4R1 or later
  • JSC client must be version 25.4 or later

Note: Older versions will not support SAML browser-based authentication

 

2. Keycloak Configuration Essentials
Create a dedicated realm (e.g., vpn-lab)
Configure a SAML client:

Entity ID: https://vpn.lab.local (must exactly match SRX)
ACS URL:
https://vpn.lab.local/saml2/acs

Disable:
Client signature required (SRX sends unsigned requests)


Add email attribute mapper:
Attribute Name: email
Required for SRX user mapping


Create users with:
Valid email
Password set (non-temporary)

 

3. Certificate Requirements

Use a CA-signed certificate for SRX (self-signed will fail)
Export and install:

Keycloak signing certificate → on SRX
SRX CA certificate → on client machines

 

4. SRX Configuration Highlights

Configure:
SAML Service Provider (SP)
Keycloak as Identity Provider (IdP)

Map username:
attribute-mapping username email

Configure access profile with:
authentication-order saml

Enable remote access profile for VPN

Important:
set security remote-access client-config <config> no-eap-tls

Prevents unwanted certificate PIN prompts

 

5. Client-Side Requirements (Windows)

Install JSC 25.4+
Copy CA certificate to:
C:\ProgramData\Juniper\SecureConnect\cacerts\

Ensure DNS or hosts entry:
vpn.lab.local → SRX IP

Make sure the client can reach Keycloak before VPN connects

  • Login Behavior:
  • User starts VPN connection
  • Browser opens → redirects to Keycloak
  • User logs in → SAML assertion sent to SRX
  • VPN tunnel established automatically

Tip: Enter full email in JSC username field, even if Keycloak username is shorter.

Modification History

Created article