topic Re: Agent Client Settings user name match when SAML in GlobalProtect Discussions

Agent Client Settings user name match when SAML

Anbjorn — Fri, 23 Sep 2022 12:14:21 GMT

I have a SAML setup where I want to match a specific user name to an agent config in the gateway:

Gateway -> Agent -> Client settings ->

Source User : <username>

OS: Any

Region/IP address: empty

In the SAML authentication profile the username is listed in the Allow List and is authenticated correctly. However, the client errors with "Client config not found". If I set Source User in Agent Client settings to Any, it works and user name show up in both traffic and GP logs.

Documentation says "You must configure group mapping (Device > User Identification > Group Mapping Settings) before you can select users and groups.", but this is only for AD group mapping. How can I match the username in the SAML login in the Agent client setting?

Re: Agent Client Settings user name match when SAML

aleksandar.astardzhiev — Mon, 10 Oct 2022 14:24:23 GMT

Hi @Anbjorn ,

How do you configure the username for the client settings? Are you using "user@domain.com" or "domain\user" format?

If you set source username as any and clients connect and get settings successfully, what format you see for the username in the GlobalProtect logs?

Re: Agent Client Settings user name match when SAML

Anbjorn — Wed, 12 Oct 2022 07:33:17 GMT

Usernames are "user@domain.com" on both logs and configuration.

Re: Agent Client Settings user name match when SAML

tamerfahmy — Tue, 28 Feb 2023 17:09:39 GMT

Hi @Anbjorn - did you ever figure this out? I am having a similar issue. I am using SAML and I have an "any" user config which works fine. But I am trying to add a more restrictive config above that one, which contains specific users or groups, and cannot get it to work. All users keep matching the "any" rule.

Re: Agent Client Settings user name match when SAML

gudmundur — Mon, 15 Jan 2024 16:04:56 GMT

Same here

We are able to supply configuration to SAML groups using cloud identity engine to pull user to group membership.

But we can not supply configuration directly to saml users

Did anyone figure this out ?

We do not have any AD or LDAP for user group matching