topic Re: Cloud Identity Engine for On-Premises Global Protect in Cloud Identity Engine Discussions

Cloud Identity Engine for On-Premises Global Protect

OwenFuller — Thu, 23 Jun 2022 19:05:10 GMT

Has anyone used the Cloud Identity Engine for authentication for an on-prem Global Protect portal/gateway?

I'm experimenting with the CIE. It works great for admin login to the GUI, but I'm trying to set it up as an auth source for GP. It is working just fine on the portal for web browser auth (i.e. to download the agent), but I'm getting authentication failures when I try to login w/ the agent itself. The browser will open, and redirect to Okta. However, after redirecting back to the firewall, I get a message saying "Authentication failed. Please click the button below to relaunch authentication." The retry button takes me back through a similar flow, and then I ultimately get a message that says "Authentication Failed. Please contact the administrator for further assistance. Error code: 0."

Re: Cloud Identity Engine for On-Premises Global Protect

dmitriy.yasnovsky — Mon, 11 Jul 2022 17:34:28 GMT

Hi OwenFuller,

Did you solve this problem?

Because I got the same alarm "Authentication Failed. Please contact the administrator for further assistance. Error code: 0."

We use GP and google idp.

Re: Cloud Identity Engine for On-Premises Global Protect

Maxstr — Thu, 21 Jul 2022 20:29:19 GMT

I'm also getting this error with Azure, even though the connection is successful. When connecting with GP to our firewall, the first browser window that pops up with Azure MFA. I log in, then another browser pops up and displays the "Authentication Failed: please contact the administrator" message (at the URL https://[my-firewall]/SAML20/SP/ACS )

Clicking "Login Retry" causes it to open another browser window with the message "When you see the dialog on the browser, click Open GlobalProtect. If the dialog does not appear, click here to launch GlobalProtect." Then when I click to that link to launch it, it successfully connects.

On the firewall itself, there are no error logs and the Cloud Identity Engine logs all say Successful.

PAN-OS: 10.1.5-h2
GlobalProtect Agent: 6.0.1

Re: Cloud Identity Engine for On-Premises Global Protect

OwenFuller — Fri, 22 Jul 2022 19:41:34 GMT

I still have an active TAC case open. More troubleshooting on Monday.

Re: Cloud Identity Engine for On-Premises Global Protect

emyl_79 — Wed, 27 Jul 2022 14:51:18 GMT

Did you find a solution with TAC? Having the same identical issue...

Re: Cloud Identity Engine for On-Premises Global Protect

OwenFuller — Wed, 27 Jul 2022 17:32:57 GMT

Case still open. Last troubleshooting session was yesterday. Not much progress though, in my opinion.

Re: Cloud Identity Engine for On-Premises Global Protect

emyl_79 — Thu, 28 Jul 2022 16:51:46 GMT

I've made some tests in my lab, it looks like it's actually working on PAN-OS 10.2.2-h1 and not on 10.1.6...

Re: Cloud Identity Engine for On-Premises Global Protect

OwenFuller — Fri, 29 Jul 2022 15:10:14 GMT

Well that's good to know. Unfortunate, but good to know. I'll pass this along to TAC.

Re: Cloud Identity Engine for On-Premises Global Protect

DuncanSmith — Tue, 30 Aug 2022 07:29:13 GMT

Any update on this? We're getting the same issue.

Re: Cloud Identity Engine for On-Premises Global Protect

Jon_Woloshyn — Tue, 06 Sep 2022 23:06:59 GMT

I was struggling to get this working both on-prem and with Prisma Access and was getting the same error message. Turns out you have to enable Use Default Browser for SAML in the App settings on the GP portal. Started working properly for me after that.

Re: Cloud Identity Engine for On-Premises Global Protect

OwenFuller — Wed, 07 Sep 2022 14:11:17 GMT

That's what they told me to do as well, but it's already enabled. Still broken. About to give up on this, and just close my TAC case.

Re: Cloud Identity Engine for On-Premises Global Protect

JuanTraverso — Thu, 05 Sep 2024 21:02:10 GMT

Owen, were you finally able to make this work? We have the same issue.

Re: Cloud Identity Engine for On-Premises Global Protect

vbovone — Mon, 02 Feb 2026 17:18:42 GMT

I'm dealing now with the same issue. Any clue? thanks