Configure OIDC Authentication with AuthPoint and the WatchGuard Cloud Directory

Applies To: Locally-managed Fireboxes

Some of the features described in this version of Fireware Help are only available to participants in the WatchGuard Beta program. If a feature described in this topic is not available in your version of Fireware, it is a beta-only feature.

You can configure your Firebox to use AuthPoint and the WatchGuard Cloud Directory for OIDC authentication. With this setup, the users you add to AuthPoint and the WatchGuard Cloud Directory can authenticate to:

  • The Access Portal (this includes reverse-proxy actions that use Access Portal login)
  • Mobile VPN with SSL (the client opens a browser for the login)
  • The Firebox Authentication Portal

To use the WatchGuard Cloud Directory as an authentication server on your Firebox, you must have an AuthPoint license and you must add an OIDC resource in AuthPoint.

Note: For detailed steps to configure the WatchGuard Cloud Directory as an authentication server on a cloud-managed Firebox, go toAdd an Authentication Domain to a Firebox or Firebox WatchGuard Cloud Directory Integration with AuthPoint (OIDC).

WatchGuard Cloud Directory authentication does not support Mobile VPN with IKEv2, Mobile VPN with L2TP, Mobile VPN with IPSec, Guest Administrators, or Fireware Web UI administrator login.

To set up AuthPoint MFA for these features, configure an AuthPoint Firebox resource or use another supported authentication method. For more information, go to Configure MFA for a Firebox.

Before You Begin

Before you configure WatchGuard Cloud Directory authentication:

  • Make sure you have WatchGuard Cloud Directory users or groups. For more information, go to About the WatchGuard Cloud Directory.
  • For Entra ID users, sync the users into AuthPoint as an External Identity.
  • Have an FQDN that resolves to the Firebox external interface (for example, firebox.example.com).

Configure WatchGuard Cloud Directory and AuthPoint Authentication

The steps in this section cover how to set up the WatchGuard Cloud Directory as an authentication server on your locally-managed Firebox.

  1. Select Authentication > Servers.
  2. Select WatchGuard Cloud Directory.
    The WatchGuard Cloud Directory settings open.
  3. Select the Enable WatchGuard Cloud Directory check box.
  4. In the Host Name text box, type the FQDN that resolves to the Firebox (for example, firebox.example.com).
    The Firebox shows the Firebox callback URL, for example https://firebox.example.com/auth/oidc/callback.
  5. In AuthPoint, add an OIDC resource for the Firebox:
    1. Log in to WatchGuard Cloud.
    2. Select Configure > AuthPoint.
    3. From the AuthPoint navigation menu, select Resources.
    4. Click Add Resource.
      The Add Resource page opens.
    5. From the Type drop-down list, select OIDC.
    6. In the Name text box, type a name for the resource.
    7. In the Login URL text box, type the Login URL.
    8. In the URI text box, type the Firebox callback URL (for example, https://firebox.example.com/auth/oidc/callback).
    9. Click Save.
      AuthPoint creates the resource. To copy the Issuer URL, Client ID, and Client Secret, open OIDC Resource Information for the resource.
  6. On the Firebox, paste the Issuer URL, Client Id, and Client Secret.

    Note: If you regenerate the Client Secret later, update the Client Secret on the Firebox.

  7. Click Save.
  8. If you have MFA users in the WatchGuard Cloud Directory, add your OIDC resource to a zero-trust policy that only requires password authentication (no MFA). For more information, go to About Zero Trust Policies.
  1. Select Setup > Authentication > Authentication Servers.
  2. Select the WatchGuard Cloud Directory tab.
  3. Select the Enable WatchGuard Cloud Directory check box.
  4. In the Host Name text box, type the FQDN that resolves to the Firebox (for example, firebox.example.com).
    The Firebox shows the Firebox callback URL.
  5. In AuthPoint, add a standard OIDC resource for the Firebox:
    1. From the AuthPoint navigation menu, select Resources.
    2. Click Add Resource.
      The Add Resource page opens.
    3. From the Type drop-down list, select OIDC.
    4. In the Name text box, type a name for the resource.
    5. In the Login URL text box, type the Login URL.
    6. In the URI text box, type the Firebox callback URL (for example, https://firebox.example.com/auth/oidc/callback).
    7. Click Save.
      AuthPoint creates the resource. To copy the Issuer URL, Client ID, and Client Secret, open OIDC Resource Information for the resource.
  6. On the Firebox, paste the Issuer URL, Client Id, and Client Secret.

    Note: If you regenerate the Client Secret later, update the Client Secret on the Firebox.

  7. Click OK.
  8. If you have MFA users in the WatchGuard Cloud Directory, add your OIDC resource to a zero-trust policy that only requires password authentication (no MFA). For more information, go to About Zero Trust Policies.

Add Users and Groups

Add users or groups that use the WatchGuard Cloud Directory authentication domain. The names must exactly match the WatchGuard Cloud Directory or AuthPoint group names. This is case-sensitive.

You can specify these users and groups in firewall policies, aliases, Access Portal application settings, and Mobile VPN with SSL allowed users and groups. You cannot disable WatchGuard Cloud Directory authentication while it is referenced by users, groups, or features.

Authentication Portal, Access Portal, and Mobile VPN with SSL

After you enable WatchGuard Cloud Directory authentication:

  • Authentication Portal — Users can select WatchGuard Cloud Directory (OIDC) to log in. If SAML is also enabled, the portal can show separate options for SAML and OIDC.
  • Access Portal — Add the WatchGuard Cloud Directory authentication domain and users or groups in Access Portal settings. For reverse-proxy applications, OIDC authenticates Access Portal login only.
  • Mobile VPN with SSL — Add WatchGuard Cloud Directory as an authentication server and allow the WatchGuard Cloud Directory users or groups. The SSL VPN client opens a browser for AuthPoint login.

Session Timeouts and Logout

Global concurrent login and session or idle timeout settings can apply to WatchGuard Cloud Directory users. Block Failed Logins and Account Lockout settings do not apply to OIDC authentication failures. AuthPoint and WatchGuard Cloud handle OIDC authentication failures.

Note: When a user logs out of the Firebox portal or SSL VPN client, the Firebox session ends. The AuthPoint SSO session can remain until it expires.

Related Topics

Authentication Server Types

Set Global Firewall Authentication Values

Configure SAML Single Sign-On

Configure MFA with OIDC

Configure MFA for a Firebox

About the WatchGuard Cloud Directory

Add the WatchGuard Cloud Directory (OpenID Connect)