topic Global Protect Azure MFA SAML FIDO Key in GlobalProtect Discussions

Global Protect Azure MFA SAML FIDO Key

ISchickling — Thu, 19 May 2022 10:07:56 GMT

Hi,

I configured Global Protect with Azure MFA (SAML).I have set this up as described here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE

Unfortunately I can´t see the FIDO Key in the Login-mask. The other authentification methods are displayed.

Since some users have only one FIDO key the question would be if the keys are supported and how do I set this up?

PAN-OS: 10.1
Global Protect-Version: 5.2.11 and 6.0.1

Re: Global Protect Azure MFA SAML FIDO Key

ArnljotSeemSPK — Wed, 31 Jan 2024 07:47:29 GMT

Old question without answer....

It seems that the embedded browser in the Global Protect client does not support FIDO MFA. Instead, configure Global Protect to use the default system browser. This works with Fido, but not as smooth as authenticating with the embedded browser.

Palo Alto Networks does not state the lack of support directly, but there is a hint of this information here: https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/default-browser-for-saml-authentication

I found the solution to this problem here: https://community.rsa.com/s/article/FIDO-Authentication-Section

Re: Global Protect Azure MFA SAML FIDO Key

PStenstadvold — Wed, 20 Mar 2024 10:57:39 GMT

The embedded browser support for Fido is soon to arrive in the next 6.2.3 version 😊

Seems to work fine (I testet a pre release build), the Fido option is then presented as expected in this browser.