topic Using Attributes to control Global Protect Access in GlobalProtect Discussions

Using Attributes to control Global Protect Access

JJancel — Mon, 04 Oct 2021 20:36:40 GMT

I'm using Google as my IDP to authenticate access to Global Protect for the bulk of my users. I have a second gateway/portal that is just local users/groups and I have policies that restrict their access, and I want to mimic that with my main PortalGateway. Ideally I want to pass an attribute to PA that says this person gets this access. I am familiar with adding attribute fields on the IDP side. What I don't know is what is configurable on the PA side?

Re: Using Attributes to control Global Protect Access

BPry — Tue, 05 Oct 2021 02:08:28 GMT

@JJancel,

I'm not entirely clear on what you are actually attempting to accomplish here. What resources GlobalProtect uses receive should be done through the security rulebase, not through attributes.

Re: Using Attributes to control Global Protect Access

JJancel — Tue, 05 Oct 2021 11:54:30 GMT

Look at step 5 of this document, https://www.bitbodyguard.com/articles/palo-alto-networks/google-cloud-identity-as-saml-idp/. I want to use attributes to pass settings that are applied to the person logging in.