topic Re: Global Protect yubikey config in Integration Discussions

Global Protect yubikey config

Brandon-Harward — Tue, 01 Feb 2022 17:18:59 GMT

I need to integrate my yubikey into the global protect client, i will at some point really soon have many users that will have a yubikey and will want to use them.

Re: Global Protect yubikey config

SteveKrall — Thu, 10 Mar 2022 00:17:25 GMT

No response? Sad.

Re: Global Protect yubikey config

lprzybyl — Thu, 31 Mar 2022 22:58:59 GMT

Hi,
to make long story short IMO - you can't use Yubikey directly as a additional factor in GP.
You'll need to have external service to integrate with and use it as an idP (identity Provider). There you can setup Yubikey as an additional Auth factor.
ref: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/authentication-types/multi-factor-authentication.html
ref: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/authentication/configure-globalprotect-to-facilitate-multi-factor-authentication-notifications.html

Re: Global Protect yubikey config

CymonS — Mon, 25 Apr 2022 16:12:12 GMT

I have been working on YubiKeys and GP, we were not really looking for a MFA solution for GP but it would appear that we have one, and it's quite cool. Albeit we do have another issue with a Windows Security Cert pop-up, which does not really create an issue but is an additional step we would like to remove. My guess it that when the GP agent authenticates it sees the user cert and want's to know if it should be used. I am looking for work arounds for this, any ideas?

Re: Global Protect yubikey config

jkim12 — Fri, 24 Mar 2023 19:02:32 GMT

specify the cert OID so it only uses the cert you want