topic Re: Azure SAML authentication: validate identity provider certificate. (best pratices) in Next-Generation Firewall Discussions

Azure SAML authentication: validate identity provider certificate. (best pratices)

zGomez — Thu, 25 May 2023 10:18:29 GMT

Hi,

We have configured SAML on our portal and gateway. By default Microsoft generates a self signed certificate that is valid for 3 years for every Enterprise application you create.

Is this secure enough to use the default self signed one and not validate it on my gateway/portal leave the check unmarked.

According to this article it should be save if you are running the correct version of Panos.

Securing your SAML Deployments - Knowledge Base - Palo Alto Networks

CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication (paloaltonetworks.com)

We could generate a certificate from our Internal PKI and upload this in Azure.

What is the best pratice aroudn this.

Re: Azure SAML authentication: validate identity provider certificate. (best pratices)

S.Cantwell — Thu, 25 May 2023 22:39:46 GMT

Hi there.. I think with today's modern PANOS, this not going to be an issue. We routinely do SAML cert setups in our PS organization and the Validate Cert is always disabled.

Hope this helps.

Re: Azure SAML authentication: validate identity provider certificate. (best pratices)

AgilysysNetOps — Thu, 01 Feb 2024 10:42:21 GMT

Hi ZGomez, curious to know that did you checked the validate identity provider certificate. if so , then how did you get the identity provider certificate ?

Re: Azure SAML authentication: validate identity provider certificate. (best pratices)

zGomez — Wed, 07 Feb 2024 10:16:14 GMT

Hi,

I ended up not checking the validity. But on the Azure side you could generate, import your own certificate on the Application.

Or you can download it from there (the self signed).

On Entra-ID go to Enterprise applications search for you Global Protect Application, single sign-on , saml certificate here you could use your own or download the existing self signed.

You will have to import his on palo alto.

I believe it would be more safe to check the cert but also an overhead in administration. The roll over happens every 3 years so you would also have te re-import it then on PANOS after roll over.