Panorama admin UI - Okta SAML

avivda — Mon, 28 Oct 2024 13:09:51 GMT

Hi, we are trying to configure the Panorama SAML authentication within our Okta tenant, and we couldn't get it done due to an invalid sign-in certificate in the "Authentication profile" section.

We have followed the following Palo Alto and Okta documents below, generated an authority certificate, and published it to the Okta app via the API call according to the Okta CSR generation process:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UXP#:~:text=updated%20it%20manually.-,Steps%20to%20configure%20CA%2Dissued%20certificate%20and%20enable%20Validate%20Identity%20Provider%20Certificate%20on%20PAN%2DOS%C2%A0,-Step%201%20%2D%20%C2%A0Add

https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Palo-Alto-Networks-Admin-UI.html?baseAdminUrl=https://monday-admin.okta.com&app=paloaltonetworkssaml&instanceId=0oa158vs8abQAHd2q358

It seems like Palo Alto detects sign in certificates only if they are within a private key in the profile itself and not by request as Okta works (Every sign request generates a key)

I'm wondering how to make it work if we have a signed authority certificate that works great on Okta(the logs show it) but is not accepted by the Panorama console.

It would be great if someone who is familiar with the process could give us some insights about connecting the Panorama admin UI within Okta SAML.

Thanks!

topic Panorama admin UI - Okta SAML in Panorama Discussions

Panorama admin UI - Okta SAML

Re: Panorama admin UI - Okta SAML