topic Re: Using Keycloak as idP in GlobalProtect Discussions

Using Keycloak as idP

Anbjorn — Tue, 01 Nov 2022 17:08:15 GMT

Has anyone succeeded in using Keycloak as idP with Globalprotect?

We're having issues with the windows clients receiving "You are already logged in" while trying to log in, which also make the gp app hang. The GP app for macOS never experience this.

We've also experienced with openconnect on Ubuntu (since Palo's own ubuntu GP app does not work at all for us) using a wrapper handling the saml auth. This also works well with Keycloak.

Re: Using Keycloak as idP

BPry — Tue, 08 Nov 2022 01:44:03 GMT

@Anbjorn,

Just looking into this briefly, you probably want to ask this on a keycloak forum as well if you haven't to gain some additional traction. Since Keycloak is the one servicing this response when encountering an already established session, GlobalProtect doesn't know how to handle the response.

Re: Using Keycloak as idP

AGrijalba — Fri, 01 Sep 2023 11:13:33 GMT

As silly as this seems, don't use Enter key, use mouse click to submit the forms.

The fix is to use the "TRANSLATEENTERKEY" option (modify registry or at install).

Alternatively, use system browser instead of the embedded one.

I made it work once in Ubuntu with "gp-saml-gui", but it seems to break now for different reasons.

Re: Using Keycloak as idP

F.Pathan084148 — Wed, 19 Nov 2025 11:16:48 GMT

Please provide us the steps to connect palo alto global protect with keycloak. As we integrate and try to connect global protection it shows an error of https://ip/saml20/sp/acs redirects error.