topic Re: Azure SAML Authentication with multiple PAs in GlobalProtect Discussions

Azure SAML Authentication with multiple PAs

minow — Wed, 17 Feb 2021 05:18:18 GMT

Hey,

We have a GP configuration with 8 GP Gateways and 2 of them are acting as a GP Portal for backup.

We are using SAML authentication with Azure and wanted to know how to you deploy GP with SAML authentication in large scale.

Currently I have configured 3 SAML apps on Azure one for each PA device but I think it is not the right configuration since now I am getting that each SAML App's domain need to be unique and the Portal domain is for example: vpn.company.com and I need to deploy it to 2 SAML Apps.

My assumptions are that because we only use SP Initiated SAML authentication meaning that the authentication process starts at the PA device I can just add all of the domains that are relevant on a single SAML App and install that Metadata file on all of the Pas. Am I right ?

Re: Azure SAML Authentication with multiple PAs

sebastianvd — Wed, 17 Feb 2021 11:35:46 GMT

I just have installed 2 standalone Palo Alto's with SAML. With only 1 Enterprise App in Azure.

So i don't think you need more apps.

Why would you need 2 Apps ?

Re: Azure SAML Authentication with multiple PAs

minow — Wed, 17 Feb 2021 12:05:30 GMT

probably my missunderstanding.

so you have put both of the PA's URLs on the SAML App on Azure ?

and import the metadata to both of the PAs ?

thanks

Re: Azure SAML Authentication with multiple PAs

sebastianvd — Wed, 17 Feb 2021 13:22:06 GMT

Hi,

Yes i've add both PA URL's in Azure in the same app, see below.

In our case we use an Azure Loadbalancer for the balanced portal configuration.

That portal points to the direct addresses of the firewall for the gateway connectivity.

See:

The whole point of SSO/SAML is to use a single identity provider/authentication provider (Azure AD in this case) and have multiple serviceproviders (GP Portal and Gateways in this case) use it.

Re: Azure SAML Authentication with multiple PAs

sebastianvd — Thu, 25 Feb 2021 08:26:09 GMT

Did you manage to get it working ?

Re: Azure SAML Authentication with multiple PAs

fatboy1607 — Fri, 07 Jan 2022 08:41:27 GMT

with single enterprise agent deployed you should be fine.

You just need to add multiple Identifier ( each fw for example ) and reply URL

It is working.

Re: Azure SAML Authentication with multiple PAs

BalaBWV — Sat, 05 Mar 2022 11:38:02 GMT

Hi, is this working? I'm trying to implement the same

Re: Azure SAML Authentication with multiple PAs

BalaBWV — Sat, 05 Mar 2022 11:39:11 GMT

I have added different identifier and still not working,

Re: Azure SAML Authentication with multiple PAs

minow — Sun, 06 Mar 2022 09:12:00 GMT

yes it is working as i described, 1 enterprise SAML application with all the domains that your PA are using by the way if you have a lot i thing your can use *.my.domain for example (although i don't think it is best practice)

if you have problems you can try the "miniOrange SAML Tracer" extention maybe you will see the SAML Assertions

Re: Azure SAML Authentication with multiple PAs

BalaBWV — Mon, 07 Mar 2022 07:36:24 GMT

Thank you for the reply, I use the Globalprotect portal in Azure, like this, "vpn-xxx.domain.com" and it's working fine. For gateway , its running in on-prem firewall "vpn-yyy.domain.com" , I have added vpn-yyy.domain.com in the "vpn-xxx.domain.com" ( same Azure Enterprise app) and imported metadata. Still not working. I'll try the fresh installation.

Re: Azure SAML Authentication with multiple PAs

mb_equate — Fri, 11 Mar 2022 04:29:33 GMT

Hi @BalaBWV , if AAD responds with "invalid identifier" make sure you've included the port in the Entity ID in the Enterprise app like in @sebastianvd's screenshot, i.e. https://vpn-yyy.domain.com:443/SAML20/SP as that is what the auth profile presents to the client / SP in the request. As long as you have both identities and ACS included in the app it should work for both portal and gateway.