https://live.paloaltonetworks.com/t5/globalprotect-discussions/saml-failed-login-attempt-error-mesage/m-p/512521#M3096 <P>We have SAML setup for GP where we check if user is member of the allow list in the auth profile.&nbsp;</P> <P>We have some illegal attempts which show up in system log with only 2 entries, 'saml-client-redirect' and 'auth-fail' with error message&nbsp;</P> <P>"failed authentication for user \'*******\'. Reason: User is not in allowlist. auth profile \'********\', vsys \'vsys1\', From: ********."</P> <P>i.e. lacking both 'saml-signature-validated' and 'saml-idp-activity'.</P> <P>&nbsp;</P> <P>Question: is "User is not in allowlist" the error message regardless if the SAML token is validated or not?</P> Mon, 22 Aug 2022 11:43:32 GMT Anbjorn 2022-08-22T11:43:32Z https://live.paloaltonetworks.com/t5/globalprotect-discussions/saml-failed-login-attempt-error-mesage/m-p/512521#M3096 <P>We have SAML setup for GP where we check if user is member of the allow list in the auth profile.&nbsp;</P> <P>We have some illegal attempts which show up in system log with only 2 entries, 'saml-client-redirect' and 'auth-fail' with error message&nbsp;</P> <P>"failed authentication for user \'*******\'. Reason: User is not in allowlist. auth profile \'********\', vsys \'vsys1\', From: ********."</P> <P>i.e. lacking both 'saml-signature-validated' and 'saml-idp-activity'.</P> <P>&nbsp;</P> <P>Question: is "User is not in allowlist" the error message regardless if the SAML token is validated or not?</P> Mon, 22 Aug 2022 11:43:32 GMT https://live.paloaltonetworks.com/t5/globalprotect-discussions/saml-failed-login-attempt-error-mesage/m-p/512521#M3096 Anbjorn 2022-08-22T11:43:32Z