topic Re: Embedded Browser agent does not work in GlobalProtect SAML Authentication in GlobalProtect Discussions

Embedded Browser agent does not work in GlobalProtect SAML Authentication

UtkarshKumar — Mon, 22 May 2023 19:19:31 GMT

The customer is using PAN-OS 10.2.4-h2, and configuring GlobalProtect agent setting "Use the Default System Browser for SAML Authentication" to "No" does not disable the default system browser for GlobalProtect SAML authentication.

The embedded browser in GlobalProtect does not work correctly and every time we try to logon though default system browser is set to NO. We see the default browser opens up.

This issue occurs on both Windows and macOS devices using GlobalProtect version 6.1.1. We are using Cloud Identity Engine as the SAML auth provider for GlobalProtect.

We also have another deployment using PAN-OS 10.1.6-h6 and GP Client - 6.0.1 on the gateway and we see embedded browser to work correctly.

We are testing using the same Windows/Mac Client with GP 6.1.1 and when connected to PAN-OS 10.2.4-h2 we see that embedded browser does not work correctly.

Has anyone faced the same issue before? I checked and cannot see anything documented in known limitations as well.

Thanks.

Re: Embedded Browser agent does not work in GlobalProtect SAML Authentication

znazir — Thu, 21 Sep 2023 07:43:15 GMT

If you are using CIE as the method of authentication, you cannot use the embedded browser. It will always use the default browser even if you uncheck the "Use default browser" box.

Re: Embedded Browser agent does not work in GlobalProtect SAML Authentication

Vinod_Pathuri — Fri, 02 Aug 2024 19:27:56 GMT

Make sure you have applied below in registry

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings

default-browser as yes

and in agent settings in portal mark default-browser as yes

Re: Embedded Browser agent does not work in GlobalProtect SAML Authentication

ChrisRice — Thu, 12 Sep 2024 14:43:00 GMT

Embedded browser is not currently supported if you use CIE. It is supposed to be fixed in a 6.2x release I have been told.

Re: Embedded Browser agent does not work in GlobalProtect SAML Authentication

SPAMatHH — Wed, 11 Feb 2026 17:13:58 GMT

Still not working in 11.1.13 with GP 6.3.3.

TAC had me try a registry key entry of with no luck having a value of yes or no:
REGISTRY KEY: HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings
REGISTRY VALUE: entra-sso
REGISTRY TYPE: string
REGISTRYY DATA: no
Then restart the PanGPS service