> Source: [sk182711](https://support.checkpoint.com/results/sk/sk182711)

# sk182711 - SAML Identity Provider authentication failure for Remote Access VPN on macOS Safari 18 

| Property | Value |
|----------|-------|
| Solution ID | sk182711 |
| Date Created | 2024-09-28 |
| Last Modified | 2025-09-15 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | E89.X, E88.X |
| OS | macOS |

## Symptoms

- * The *idp_browser_mode* fails to authenticate for Remote Access VPN when configured on macOS Safari 18.
* The *idp_browser_mode* is configured as default_browser, and the System Settings have Safari set as the default web browser.

## Cause

The latest Safari version (18.0) is disrupting communication between the SAML Identity Provider portal and the Remote Access client.

## Solution

### Preliminary solution

As of today, we offer a preliminary solution for SAML authentication issue. This is fast fix which allows users to pass SAML authentication using Safari 18 browser. The solution slightly changes user experience: end user needs to allow Check Point web site to open "Endpoint Security VPN.app".  

The fix consists of custom builds of VPN client and gateway hotfix. Use links bellow to download relevant installer.  

#### *Custom build of Endpoint Security E88.70 Clients for macOS*

|-------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------|
| Package                                                                                                     | Link                                                          |
| Check Point Endpoint Security Client for macOS                                                              | [ZIP](https://support.checkpoint.com/results/download/135409) |
| Check Point Endpoint Security Client for macOS (without Capsule Docs and Advanced Threat Prevention blades) | [ZIP](https://support.checkpoint.com/results/download/135410) |
| Check Point Endpoint Security Client for macOS - Initial Client                                             | [ZIP](https://support.checkpoint.com/results/download/135411) |

#### *Custom build of E88.70 Standalone Clients for macOS*

|-----------------------------------------------------------------------|---------------------------------------------------------------------|
| Package                                                               | Link                                                                |
| Remote Access VPN Clients for macOS - Disc Image (DMG)                | [DMG](https://support.checkpoint.com/results/download/135405)       |
| Remote Access VPN Clients for macOS - Automatic Upgrade package (PKG) | [PKG](https://support.checkpoint.com/results/download/135406)       |
| Remote Access VPN Clients for macOS - Signature for Automatic Upgrade | [Signature](https://support.checkpoint.com/results/download/135407) |

#### *Gateway fix*

|-------------------------------------------------------------------------------------------------------|---------------------------------------------------------------|
| Package                                                                                               | Link                                                          |
| Fix for SAML authentication issue in Safari 18. Applicable to R81, R81.10, R81.20 security gateways\* | [TGZ](https://support.checkpoint.com/results/download/135404) |

\* The fix can be installed on top of R81, R81.10 and R81.20 with any Jumbo installed. Follow instructions bellow:  

1. Open terminal and run the following command to change to the specified directory:

   ```
   cd /opt/CPSamlPortal/phpincs/spPortal/saml-vpn/
   ```

2. Create a backup of the existing redirect.php file by executing:

   ```
   cp redirect.php redirect.php.orig
   ```

3. Extract and replace the current redirect.php file with the one from security_gateway_fix.tgz. Make sure you have the security_gateway_fix.tgz file in the current directory, then run:

   ```
   tar -xzvf security_gateway_fix.tgz redirect.php
   ```

4. After replacing the file, set the appropriate permissions by running:

   ```
   chmod 644 redirect.php
   ```

Make sure to verify each step for accuracy and ensure you have the necessary permissions to perform these actions.  

### Workaround

In case if preliminary solution doesn't work for some reason, please use workaround bellow.  

If Safari is updated to the latest version, switch to a different browser for authentication with the SAML Identity Provider, based on the *idp_browser_mode* configuration.  

You can configure the *idp_browser_mode* in the following ways:  

* For **mac_E88_40** and below: The VPN client reads *idp_browser_mode* configuration from *Trac.defaults* file (per machine configuration)
* For **mac_E88_50** and above: The VPN client reads *idp_browser_mode* from the *trac_client_1.ttm* file (per gateway configuration). If not configured there, it falls back to the *Trac.defaults* file (per machine configuration).

To implement the workaround, based on your VPN client version:  

* For **mac_E88_40** and below and for **mac_E88_50** above (if *trac_client_1.ttm* is not used):
  * Change*idp_browser_mode* to use *default_browser* in *Trac.defaults*.
  * Set a different browser as the default in macOS System Settings.
* For **mac_E88_50** and above (if *trac_client_1.ttm* is used):
  * Change *idp_browser_mode* to use *default_browser* in *trac_client_1.ttm*.
  * Set a different browser as the default in macOS System Settings.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content