topic Re: Palo Alto Kerberos for sso in Next-Generation Firewall Discussions

Palo Alto Kerberos for sso

bbashash81 — Sat, 16 Aug 2025 12:52:57 GMT

Anyone hit the same issue before?

2025-08-16 20:35:38.768 +0800 debug: pan_auth_cache_get_authprof_info(pan_auth_cache_authprof_n_authseqprof.c:218): prof "KRB-SSO", vsys "vsys1" (method: Kerberos pre-auth) has sso hash table id: 1 (0 means no or invalid keytab)

Re: Palo Alto Kerberos for sso

bbashash81 — Sun, 17 Aug 2025 07:11:12 GMT

anyone have the steps for kerberos with captival portal?

The issues i'm facing is when i enter a external website and it will prompt me with the login prompt. If i login and is working fine but end goal is to do SSO via kerberos for captival portal.

From the client, i should have seen this but it doesn't appear.

from the firewall without login to the prompt, i always see these error. I have regenerate the keytab for more than 10 times. and i have check the version of kerberos from the AD server and the keytab via the below command. both are the same version.

Ktpass /in <filename.keytab>
− dsquery * -filter sAMAccountName=<accountname> -attr msDS-KeyVersionNumber

2025-08-17 14:58:59.172 +0800 debug: pan_auth_cache_get_authprof_info(pan_auth_cache_authprof_n_authseqprof.c:218): prof "KRB-SSO", vsys "vsys1" (method: Kerberos pre-auth) has sso hash table id: 1 (0 means no or invalid keytab)
2025-08-17 14:58:59.193 +0800 debug: pan_auth_request_process(pan_auth_state_engine.c:3618): Receive request: msg type PAN_AUTH_REQ_GET_AUTHD_ID, conv id 168, body length 2448
2025-08-17 14:58:59.193 +0800 debug: _log_auth_respone(pan_auth_server.c:625): Sent PAN_AUTH_GET_AUTHD_ID_SUCCESS auth response for user '' (exp_in_days=-1 (-1 never; 0 within a day))(authd_id: 7539262304362168525)

Re: Palo Alto Kerberos for sso

PavelK — Mon, 18 Aug 2025 06:10:24 GMT

Hello @bbashash81

thanks for post!

To me this log message does not indicate an issue / authentication failure. Could you please elaborate where and for what purpose you are setting up Kerberos authentication?

If the authentication is failing there should be more detailed log after the log message you shared. Just in case, here is Configure Kerberos Single Sign-On configuration guide.

Kind Regards

Pavel

Re: Palo Alto Kerberos for sso

PavelK — Tue, 19 Aug 2025 00:25:49 GMT

Hello @bbashash81

thank you for reply.

From your post it looks like that your Keytab has been generated correctly, however just in case here is a manual: How To Generate Kerberos Keytab for SSO. Make sure that FQDN for captive portal is resolvable and pointing to Firewall's interface where Captive Portal is enabled.

Here is the tutorial for Captive Portal setup: How to Configure Captive Portal. In Step No.6 import Kerberos Keytab. Also make sure that certificate's SAN field is FQDN of Captive Portal.

Make sure that in authentication policy you configured browser challenge to trigger SSO (Step No.3): Configure Kerberos Single Sign-On.

Make sure that you set redirect mode and redirect host matches certificate's SAN name: What are the client trust settings required to change the redirect URL for captive portal with Kerberos SSO?.

Finally, you will have to enable decryption: Captive Portal Not Working with HTTPS Sessions. Could you test whether captive portal SSO works for test HTTP site?

Kind Regards

Pavel