topic Re: Global Protect redirects to app authentication and not SAML Authentication in GlobalProtect Discussions

Global Protect redirects to app authentication and not SAML Authentication

mariuse — Fri, 16 Aug 2024 12:02:35 GMT

Good Day community

Looking for some advise and guidance.

we are running into an issue where we have random users trying to connect to Global Protect experiencing issues where they are not redirected to the SAML authentication page, but rather the imbedded authentication of the application itself. The user either needs to stop the services of Global Protect or reboot their system before they can connect.

We are not seeing the authentication attempts on the firewall when it fails only when they are making a successful connection.

Re: Global Protect redirects to app authentication and not SAML Authentication

JayGolf — Mon, 19 Aug 2024 23:33:19 GMT

Hi @mariuse ,

When users aren't redirected, are they connected to the correct portal configured for SAML?

Re: Global Protect redirects to app authentication and not SAML Authentication

mariuse — Tue, 20 Aug 2024 05:51:29 GMT

Hi JayGolf

Yes they are as per the configuration, but not seeing anything in logs for any failed authentication, we are only seeing logs after a reboot or successful SAML authentication. All access was working, we don't know if this is due to the recent update of the client to 6.2.2.

We are waiting for the logs from the SAML team and logs from a user.

Re: Global Protect redirects to app authentication and not SAML Authentication

KhaleelE — Tue, 20 Aug 2024 05:58:55 GMT

Try install 6.2.4 GP client version.

Re: Global Protect redirects to app authentication and not SAML Authentication

mariuse — Tue, 20 Aug 2024 06:02:06 GMT

Hi KhaleelE

We will give that a try and update.

Thank you

Re: Global Protect redirects to app authentication and not SAML Authentication

MP18 — Thu, 22 Aug 2024 02:43:53 GMT

@mariuse Which PAN OS version are you running?

Regards

Re: Global Protect redirects to app authentication and not SAML Authentication

mariuse — Wed, 28 Aug 2024 09:36:21 GMT

We are running on OS 10.1.14-h2 and we also tried running the latest GP client with still the same result.

We are currently testing forcing the clients to use only one DC and so far no issues picked up.

We are suspecting a F5 load-balance issue which they are still busy investigating.

Re: Global Protect redirects to app authentication and not SAML Authentication

mariuse — Thu, 05 Sep 2024 12:10:55 GMT

Update -

We forced user to connect to DC2 and no issues picked up, they are not testing connection to DC1 and so far no issues.

Looks like a F5 DNS load-balance issue that we are facing.