topic Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE in GlobalProtect Discussions

Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

mkukucska — Tue, 24 Oct 2023 15:38:18 GMT

Hi Team.

We would like to introduce Azure AD based authentication at our company for globalprotect connections. Azure AD and CIE integration seems to be OK, as I can login to GP portal with my Azure registered user. However, if I want to connect to the GP vpn with the client, it stuck in "Connecting" phase, even though the authentication seems to be operable in this case as well.

Log files do not tell me too much on the issue, at least I can't find anything what could be relevant. No any errors are logged, only a failed task:

(P2016-T2796)Debug(9512): 10/24/23 14:36:13:167 ----Portal Login starts----
(P2016-T2796)Debug(9515): 10/24/23 14:36:13:167 m_szSavedUserName is
(P2016-T2796)Debug(2442): 10/24/23 14:36:13:167 Failed to open file C:\Users\mkukucska\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_7b5f4a211befe9324aa9a577e857dfcd.dat
(P2016-T2796)Debug(9531): 10/24/23 14:36:13:167 Cas auth
(P2016-T2796)Debug(8724): 10/24/23 14:36:13:167 Return false for saml/cas auth

Globalprotect logs contain only successful portal-prelogin sessions. System logs report cas-client-redirect events, client is redirected to https://cloud-auth.nl.apps.paloaltonetworks.com/auth.

Is this the right place to be redirected? Did not find the option on CIE surface to change this value.

Any hint, what could be the issue?

Thank you,

Mihaly

Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

sbergeron — Thu, 18 Jan 2024 18:50:02 GMT

Hi,

We do have the same problem as you. We are also using Azure AD and CIE integration. Connection works sometimes some and doesn't for others, kind of random. Stuck at the connecting stage. Couldn't find anything revelant in PANgps logs. We had a case open for more a year and nothing came out of it. Any clues?

Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

mkukucska — Fri, 19 Jan 2024 07:55:31 GMT

HI,

My problem has been solved by enabled "Generage cookie for authentication override" and "Accept cookie for authentication override" under Portals>Agent>Configs>Authentication and enabled "Accept cookie for authentication override" under Gateways>Agent>Client settings>Configs>Authentication override. Hope this helps for you as well.

Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

sbergeron — Fri, 19 Jan 2024 14:39:29 GMT

Thanks for the quick response Mkukucska. Setting have been applied like you suggested. I'll update the thread in a couple of days with the results.

Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

Vikas_Singh — Wed, 24 Jul 2024 19:00:38 GMT

What was the output ?

Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

Rutu.Modi — Thu, 20 Feb 2025 22:16:23 GMT

We are facing the same issue. PA Case is not helping. @sbergeron - What was the result ? Did it ever resolved the issue for you ?

Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

mkukucska — Fri, 21 Feb 2025 08:20:29 GMT

Hi,

The solution I suggested above is not a big deal, why don't you try it?

Regards

Mkukucska

Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

sbergeron — Fri, 21 Feb 2025 13:20:41 GMT

Yes, it did resolve the problem for us. At least for the majority of our users. We may have another issue. Give it a try.

Enable "Generage cookie for authentication override" and "Accept cookie for authentication override" under Portals>Agent>Configs>Authentication and enabled "Accept cookie for authentication override" under Gateways>Agent>Client settings>Configs>Authentication override.

Re: Globalprotect login stuck in "Connecting" phase after successful authentication via Azure AD - CIE

MannyCosta — Thu, 24 Jul 2025 15:42:13 GMT

Cookies are on the way out and will be not best practices with AI getting a foothold in the Dark rhelm. what is the alternative to a cookie using user and specific device certifiicates instead?