topic SAML Authentication - Users not prompted for password or MFA in GlobalProtect Discussions

SAML Authentication - Users not prompted for password or MFA

SethEfrat — Fri, 10 Nov 2023 18:43:08 GMT

Hi all,

We've setup SAML / SSO and all works OK , however, when GlobalProtect starts, it automatically connects without asking for any creds. I'm assuming this is a result of the machine being joined to the same domain so the password is not needed. However, I'd like to configure it so that at least an MFA prompt occurs.

Connecting on a non joined machine does exhibit this behavior.

Re: SAML Authentication - Users not prompted for password or MFA

TomYoung — Mon, 13 Nov 2023 00:40:01 GMT

Hi @SethEfrat ,

When SAML/SSO does not prompt for creds or MFA, it is almost always an authentication cookie. Check you IdP authentication cookie settings.

Thanks,

Tom

Re: SAML Authentication - Users not prompted for password or MFA

jfernandez1 — Wed, 13 Dec 2023 13:43:04 GMT

This might be a known issue that is being addressed on PANOS 10.2.5 where addressed a situation where the firewall failed to appropriately initiate Single Log-out (SLO) towards the client, leading to the client's inability to trigger the SLO request towards the identity provider (IdP). Consequently, this led to the IdP not executing the SLO callback to the firewall for user removal.

Issue ID: PAN-213296

Can be found on PANOS 10.2.5 release notes:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-5-known-and-addressed-issues/pan-os-10-2-5-addressed-issues