topic Re: Multiple IdPs for GP Authentication in Prisma Access Discussions

Multiple IdPs for GP Authentication

AkashThangavel — Thu, 24 Apr 2025 08:03:37 GMT

Hi Team,

Today, I received a new use case from my customer.

In their Prisma Access cloud-managed environment, we have configured SAML authentication for SSL VPN connectivity.

Now, the customer has a new requirement: one of their clients needs access to their private application.

The question is—what's the best solution to provide this client with access to the private application?

We know that GP needs to be connected to access the application, but the concern is around authentication.

Can we create a separate SAML authentication profile for this specific client? OR, create users in their IdP, assign them to a specific group, and synchronize it with the SP.

Looking forward to your insights

regards,

Akash Thangavel

Network Security Engineer

Re: Multiple IdPs for GP Authentication

HKBEASunnyCheung — Tue, 06 May 2025 01:38:56 GMT

Me too. We are using Entra ID as IDP for GP authentication right now. We have our own ADFS infrastructure on-premise and need to design an alternative IDP in case Entra ID has some global service outage.

Re: Multiple IdPs for GP Authentication

reaper — Tue, 06 May 2025 13:41:24 GMT

for 1 single user it may be worth adding a 'contractor' (guest) account in their own entraID to keep things simple?

alternatively you could look into Cloud Identity Engine as you can aggregate authentication there and possibly can integrate the client's IdP as well

the Prisma Access Browser may also be a good solution to grant access to contractors without needing to allow VPN tunnels

Re: Multiple IdPs for GP Authentication

Manjeet_Yadav — Fri, 09 May 2025 03:53:13 GMT

Yes it is achievable. u can achieve this use case to integrate 2 IDP- using SAML with CIE and then use CIE for auth for global protect users.

Re: Multiple IdPs for GP Authentication

HKBEASunnyCheung — Thu, 29 May 2025 04:06:11 GMT

I think so, we are using CIE for auth now but still looking any sample setting in CIE to achieve this.