topic Re: Clientless VPN portal and SAML SSO and Application SSO in GlobalProtect Discussions

Clientless VPN portal and SAML SSO and Application SSO

DTGHelp — Wed, 17 Jan 2024 11:57:36 GMT

Hi there, I wanted to check that possibly what I'm trying isn't actually going to work. Had a look around at people with simular issues on LDAP, but I thought using SAML would solve this ... but not!

What I'm trying to achieve here is SSO into the VPN portal and then into any applications that use the same SSO method (the method we are using is SAML via Microsoft Entra (365).

I have SAML SSO working as an auth profile for the Global Protect Portal... works perfectly. I have Applications (Guacamole, One Drive) that can be accessed via the VPN portal.. but the first time I access one of these I'm prompted again for My Microsoft sign in. If I then use any other Microsoft SSO app I'm not prompted.

Is this expected as there is no link between the outside "session" and the sessions inside the portal?.. Is this possible to achieve (no double login)?

Thanks in advance.

Re: Clientless VPN portal and SAML SSO and Application SSO

Raido_Rattameister — Wed, 17 Jan 2024 18:52:34 GMT

It depends on Microsoft Entra settings.

In DUO SAML for example it is possible to configure if every application needs to be accepted with 2FA or any of them.

Re: Clientless VPN portal and SAML SSO and Application SSO

matjazp — Thu, 11 Apr 2024 12:27:30 GMT

Hi,

Did you find working solution for this kind of integration with SAML. I was able to create SAML for for Global Protect Portal and Clientless VPN. And now I want to create something similar with internal published application Guacamole with SAML, but is this possible at all, from the perspective of first SAML session of the login to GP Portal, then further use for internal published application?

Regards,

Matjaž