topic Re: GlobalProtect SAML Not working in GlobalProtect Discussions

GlobalProtect SAML Not working

LanderFeys — Thu, 08 Sep 2022 10:00:39 GMT

We have recently deployed SAML authentication on our existing GP environment and this is working fine on most devices. Currently we are in a migration phase, which means only that the gateway is using SAML and the portal is still using on prem AD credentials (not saml). A few users experience the following behaviour: when logging into their PC the client automatically starts and uses the AD crendentials to authenticate to the portal. After the portal login they are redirected to the default browser for saml authentication, but instead of getting the microsoft login page they get a white page with the following text: "Login Successful!" This results in the user not being able to connect to the vpn.

Kind Regards

Re: GlobalProtect SAML Not working

BPry — Thu, 08 Sep 2022 20:46:19 GMT

@LanderFeys,

I've seen this in the past when the SSO and SLO URLs were the same thing after being imported with Azure as the SAML provider. Are you possibly using Azure as your SAML provider or someone else?

Re: GlobalProtect SAML Not working

LanderFeys — Fri, 09 Sep 2022 06:13:49 GMT

You assume correct, we are using azure as SAML Provider and both the SSO and SLO Urls match. Do you know to what we should change the SLO URL? What I've found so far is: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0

Re: GlobalProtect SAML Not working

nikoolayy1 — Sat, 17 Sep 2022 22:38:47 GMT

Also see the saml auhententication option and the default browser option as if the browser is set to yes and saml authentication to no then it can cause issues:

https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/default-browser-for-saml-authentication

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMUmCAM