> Source: [sk182548](https://support.checkpoint.com/results/sk/sk182548)

# sk182548 - SAML authentication in Mobile Access Portal does not work in a Maestro Security Group in the VSX mode

| Property | Value |
|----------|-------|
| Solution ID | sk182548 |
| Date Created | 2024-08-11 |
| Last Modified | 2025-12-18 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Mobile Access Portal does not always show the SAML icon ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182548/microsoftonline202407301455141.png) of the SAML Login Option.

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182548/bad_saml_login_portal1202408132125361.png)
* In a web browser, Developer Tools \> "Network" tab shows that the request for the URL of the SAML Service Provider failed with error "`404 Not Found`".

  Example:

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182548/saml_SP_url202407271544472.png)

## Cause

During the Access Control policy installation, the `$SAMLPORTAL_HOME/phpincs/spPortal/idpPolicy.xml` file is not updated correctly on the non-SMO Security Group Members.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 44
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 119
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 183

If you choose not to upgrade, follow this **workaround**procedure:

The shell script `cpha_blade_config` is responsible for the policy installation task on the non-SMO Security Group Members.

**Procedure**:

1. Connect to the command line on the Security Group.

2. Log in.

3. If your default shell if Gaia gClish, then go to the Expert mode:

   `expert`
4. Back up the current `cpha_blade_config` script:

   `g_all cp -v $SMODIR/bin/cpha_blade_config{,_BKP}`
5. Edit the current cpha_blade_config script:

   `vi $SMODIR/bin/cpha_blade_config`
6. Insert the call to the `$CPDIR/tmp/.CPprofile.sh` script in the required place.

   The relevant section before the change:

   ``...``  
   ``
   else``  
   ``
   # in VSX we can have a lot of processes like these running simultaneously together hence we don't want to bind to only one core``  
   ``
   LFETCH_OUTPUT=`$FWDIR/bin/fw fetchlocal -d $FWDIR/state/__tmp/FW1 $policy_type 2>&1` >> $LOGFILE 2>&1``  
   ``
   fi``  
   ``
   ...``

   The relevant section after the required change:

   ``...``  
   ``
   else``  
   ``
   # in VSX we can have a lot of processes like these running simultaneously together hence we don't want to bind to only one core``  
   ``
   ``. $CPDIR/tmp/.CPprofile.sh  
   ``
   LFETCH_OUTPUT=`$FWDIR/bin/fw fetchlocal -d $FWDIR/state/__tmp/FW1 $policy_type 2>&1` >> $LOGFILE 2>&1``  
   ``
   fi``  
   ``
   ...
   ``
7. Save the changes in the file and exit Vi editor.

8. Copy the modified script to all Security Group Members:

   `asg_cp2blades $SMODIR/bin/cpha_blade_config -p`
9. In SmartConsole, install the Access Control policy on the Security Gateway / relevant Virtual System object.

   **Important** - In the **Install Policy** window, select "**Do not use Install Policy Acceleration for all targets**".

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182548/policy_install202407271545063.png)
10. On the Security Group, make sure the file `idpPolicy.xml` is the same on all Security Group Members (SMO and non-SMO):

    1. If this Security Group works in the VSX mode, then go to the context of the relevant Virtual System:

       `[Expert@HostName-ch0x-0x:0]# vsenv <VSID>`
    2. Compare the file `idpPolicy.xml` on all Security Group Members:

       `[Expert@HostName-ch0x-0x:<VSID>]# g_allc cat $SAMLPORTAL_HOME/phpincs/spPortal/idpPolicy.xml`

*** ** * ** ***

**Related Solutions:**   

* [sk183377: Mobile Access Portal fails to load when using SAML authentication](https://support.checkpoint.com/results/sk/sk183377)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content