SAML with Microsoft ADFS and Group Mapping

joschoenEXTA — Fri, 03 Jun 2022 11:33:49 GMT

Hi Community,

we got an on prem domain and were using LDAP auth for GlobalProtect.

So everything configured, LDAP Profile, Auth Profile with userdomain and Group Mapping with userdomain.

In operation, a logged in user is recognized as netbios\samlaccountname - everything fine.

Now we want to utilize our ADFS on-prem server.

We used this guide to configure it (its for Prisma, but the same approach):

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-cloud-managed-admin/secure-mobile-users-with-prisma-access/enable-user-authentication-for-prisma-access/configure-saml-authentication-using-adfs-as-the-idp-for-mobile-users

Even as we configured redirect on Palo side, the server retrieves Post request, so we changed that on ADFS side and now SAML SSO works - so good so far.

The problem is:

There is no userdomain info, so our whole policyset is not matching, since the user is reported as "samaccountname" - we need "netbios\samaccountname" so that the configured LDAP group mapping is working.

Does anyone has an idea how to do that with ADFS?

I haven't really found a good tutorial or documentation for it.

That relates to the settings shown in step 4 of the posting link.

Looking really forward for any hints.

Windows Account Name as an outgoing claim looked good, but didn't work

Best Regards

Johannes

topic SAML with Microsoft ADFS and Group Mapping in GlobalProtect Discussions

SAML with Microsoft ADFS and Group Mapping