Group Login condition Azure Groups

rjdahav163 — Mon, 18 Sep 2023 04:48:43 GMT

Hi,

We are using our on prem LDAP to fetch groups on the Palo. For GP authentication as well, we are using group in

1) GP Portal > Agent > Config Selection Criteria > User/User Group

2) GP Gateway > Agent > Client Settings > Config Selection Criteria

This works well with on prem LDAP. Now we are trialling out SAML with Azure. The Authentication on the SAML succeeds but GP fails to connect because the firewall cannot find the proper group for the user. After looking at logs, it looks like, when we use LDAP the user is identified as domain\username and firewall can lookup LDAP group. When using SAML authentication, the user is identified as firstname.lastname@companyname.com

Any idea how to resolve this?

topic Group Login condition Azure Groups in GlobalProtect Discussions

Group Login condition Azure Groups