topic User/Group mapping with GP SAML (User-ID) in GlobalProtect Discussions

User/Group mapping with GP SAML (User-ID)

GregorJus — Sat, 29 Mar 2025 16:59:01 GMT

Hi,

I've got GP configured with SAML authentication and it works great. However, I would need to get out User-ID or group so that I can use them in security policies to allow or deny specific rules and access to resources.

Is that possible and how?

Thanks

Re: User/Group mapping with GP SAML (User-ID)

TomYoung — Mon, 31 Mar 2025 02:22:50 GMT

Hi @GregorJus ,

Yes, it is possible. All you need to do is enable User-ID on the GP zone in order to turn it on. GP maps the username to IP address.

You have to use LDAP or Cloud Identity Engine (CIE) to map users to groups. In order for group mapping to work, the username in the "show user ip-user-mapping all" command must match exactly with the username in the "show user group name "<group_name_from_show_user_group_list>" command.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/user-id/map-users-to-groups

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/authenticate-users-with-the-cloud-identity-engine/configure-the-cloud-identity-engine-as-a-mapping-source-on-the-firewall

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpCCAS

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVcCAK&lang=en_US

Thanks,

Tom

Re: User/Group mapping with GP SAML (User-ID)

GregorJus — Mon, 31 Mar 2025 08:22:44 GMT

Hi, Tom,

Thank you for your reply, however, it doesn't quite fulfil the requirements I have, just yet. User-ID is already enabled on the zone and I can see the user in the monitor logs. However, I still can't use those users (e.g. name.lastname@domain.com) in security policies, which is what I would need to do.

LDAP is not an option here, sadly, because these are cloud only (Azure AD joined) machines only - there is no domain on-prem and no hybrid solution possible. I have already implemented CIE as well, however, the issue I am having with it is being unable to fully disable opening browser (even just one tab) with connection notification as users do not want that.

Thanks,
G

Re: User/Group mapping with GP SAML (User-ID)

TomYoung — Mon, 31 Mar 2025 10:03:18 GMT

Hi @GregorJus ,

Does the command "show user ip-user-mapping all" show users?

Does the command "show user group list" show groups? If so, pick a group and run the "show user group name "<group_name>" command. Do the usernames match the previous command exactly?

The browser (step 9 in the CIE URL I provided) is not needed if you are using GP for user/IP mapping.

Why can't you use the users in the security policy? They will not automatically show up in the drop down list. You have to start typing the name and they will show up.

Thanks,

Tom