Authentication Cookies Generation and Authentication

Garrett_Heidorn — Sat, 23 Apr 2022 00:24:31 GMT

I am trying to a set up an implementation of pre-logon, then SAML w/ Client Certificates.

Utilizing a machine certificate I can configure how I want with no issues, but using only a client (user) certificate, pre-logon doesn't work, which is expected since the certificate is not in the computer's personal store, but the user's.

In order to combat this, I've attempted to set up the following:

Portal agents:

Pre-logon	pre-logon group	Accept auth cookies
LoggedOn	any group	Generate auth cookies

Authentication Profile: SAML

Certificate profile: InternalCAProf

Gateway clients:

Pre-logon	pre-logon group	Accept auth cookies
LoggedOn	any group	Generate auth cookies

Authentication Profile: SAML

Certificate profile: InternalCAProf

As shown, I want the user to authenticate with the portal/gateway the first time utilizing SAML, a cookie should be generated, then the cookie should be accepted for pre-logon only.

PAN OS 10.2.0 (Lab environment here)

Does anyone know if this implementation is possible?

topic Authentication Cookies Generation and Authentication in GlobalProtect Discussions

Authentication Cookies Generation and Authentication