topic Re: GlobalProtect Azure Saml user/group attribute Mapping in GlobalProtect Discussions

GlobalProtect Azure Saml user/group attribute Mapping

l2-security — Tue, 26 Nov 2024 13:11:44 GMT

Hi Support,

I am trying to configure Globalprotect with Azure Saml integration.

The authentication part is configured following the link ( https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE).

Additionally usergroup in Azure are configured with the attribute "group" and is mapped to each usergroup name.

Saml authentication profile in PA firewall contains the user group attribute name as "group" (matching the usergroup attribute from Azure).

Now the question here is , do i need to create multiple Saml authentication profiles like one for the GP Portal authentication which contains the Allow list as "all",

And one each for every user group with their respective Asserted Azure user group name in Allow list. which can be called in GP Gateway authentication configuration to map the usergroup with their vpn pool and other settings.

Regards,

Re: GlobalProtect Azure Saml user/group attribute Mapping

BPry — Wed, 27 Nov 2024 01:49:01 GMT

@l2-security,

If I understand the question properly, you should be able to just have a single profile. You can utilize the user group on the portal and the gateway to control the configuration that each group receives or whether they're able to utilize that portal/gateway. So the authentication will use the single authentication profile while the actual portal agent configuration can be driven by the group alongside the gateways client settings.

Re: GlobalProtect Azure Saml user/group attribute Mapping

l2-security — Wed, 27 Nov 2024 09:39:48 GMT

@BPry ,

Thanks for the reply , It is still unclear how the GP will distinguish which usergroup gets which VPN pool range with a single authentication profile that includes the usergroups (derived from Azure saml) in the allow list..
My aim is to make sure each usergroup fetched from Azure SAML is assigned with a specific set of vpn pool range , and with that a security rule can be configured to allow specific destination access based on the vpn pool ranges.

Regards,

Re: GlobalProtect Azure Saml user/group attribute Mapping

nicoleannep — Thu, 18 Sep 2025 09:10:53 GMT

Did you manage to fix it? I am also trying to figure out how the Palo Identifies which On Premise AD group (azure synced) the user belongs to so it can match a config criteria selection and receive different VPN IP pools and also a different connect method.