topic SAML Authentication with Shibboleth error : idp has no assertion in GlobalProtect Discussions

SAML Authentication with Shibboleth error : idp has no assertion

S.DR18 — Wed, 10 Dec 2025 12:01:13 GMT

Hello,

We are setting up global protect with SAML SSO with a shibboleth IdP. But we post back to global protect after authentication we do have IdP has no assertion. SAML Tracer shows an encryted assertion but does not seems to handle it.

Is there any way to have a more verbose / debug log of SAML Authentication ?

Is there any cypher protocol restriction on PAN ?

Thanks for any help

Jean Marie THIA

Re: SAML Authentication with Shibboleth error : idp has no assertion

PavelK — Thu, 11 Dec 2025 04:00:37 GMT

Hello @S.DR18

thanks for posting!

I never dealt with this exact issue, however first thing I would be checking for more details is authentication logs from CLI: tail follow yes mp-log authd.log. The authd has by default debugging enabled: How to set the debug log level of a service back to its default level.

The potential root cause of this issue is documented here: alerts:

Kind Regards

Pavel