Cisco ASA Firewall Reports a Single Sign-On Cookie Error During Okta Authentication

A Single Sign-On (SSO) error occurs on the Cisco Adaptive Security Appliance (ASA) firewall due to a bug, misconfigured Identity Provider (IdP), or network time synchronization issues. Verifying the metadata configuration in Okta, upgrading the Cisco ASA firmware, synchronizing the network time, and re-enabling the authentication settings resolves the issue. The Cisco ASA firewall reports an SSO error while authenticating via the Cisco AnyConnect client.

Authentication failed due to problem retrieving the single sign-on cookie.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Security Assertion Markup Language (SAML)
• Cisco AnyConnect Virtual Private Network (VPN)
• Single Sign-On (SSO)

The following issues cause the problem:

• The Cisco ASA runs a code susceptible to bug CSCvi23605.
• The SAML IdP for the AnyConnect Connection profile contains a misconfiguration.
• The Cisco ASA lacks proper synchronization to an external Network Time Protocol (NTP) server.

How is the single sign-on cookie error resolved?

Verify the metadata configuration in Okta, upgrade the Cisco ASA firmware, synchronize the network time, and re-enable the authentication settings by following these steps.

1. Verify that the Cisco-provided metadata (Assertion Consumer Service URL and Service Provider (SP) Entity ID) contains the proper configuration on the Okta side. To check the Cisco-provided metadata, follow Step 11 from the Cisco ASA (SAML) VPN instructions located in How to Configure SAML 2.0 for Cisco ASA VPN.
2. Upgrade the Cisco ASA to the latest release.
3. Enable the NTP service and specify a reliable network time server for synchronization.
4. Restart the ASA.
5. Set the SAML IdP to none and then revert it back to the configured SAML IdP.
6. Re-enable SAML Authentication in the tunnel-group via the following commands in the Command Line Interface (CLI) using the Entity ID:

   ASA-DF(config-tunnel-webvpn)# no saml identity-provider
   ASA-DF(config-tunnel-webvpn)# saml identity-provider

NOTE: The resolution steps outlined above are from the Service Provider (SP) side. For questions or further assistance regarding vendor-side configurations, contact the vendor's support directly.