Upgrade to PAN OS 10.0

jbusby — Wed, 30 Mar 2022 11:25:51 GMT

Hi,

I've been on hold for nearly 3hrs trying to get through to TAC after raising my L2 ticket online, the automated message told me I should try the live community 🙂

Since upgrading to 10.0 (aiming to get to 10.1.4) admins aren't able to login to Panorama to manage prisma access.

Log shows:

Authorization failed for user jblogs@domain.com via Web from 10.3X.XX.XX : Invalid configuration. No ado/role found jbloggs@domain.com
03/30 02:35:19

SAML SSO authenticated for user 'xxx@domain.com . auth profile 'Okta-MGMT-Profile', vsys 'shared', server profile 'Okta-management-SAML', IdP entityID 'http://www.okta.com/XXXXXXXX', From:10.3X.XX.XX
03/30 02:35:19

The users have dynamic "super user" role assigned. I'm not sure what "ado" means in the above log but it seems like SAML is authenticating successfully. Any help appreciated.

Re: Upgrade to PAN OS 10.0

jbusby — Thu, 31 Mar 2022 09:10:27 GMT

Found the solution:

The upgrade must have removed this parameter that was set by a previous admin:

set auth strict-username-check no

It's actually documented here:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/upgrade-pan-os/upgradedowngrade-considerations.html

topic Upgrade to PAN OS 10.0 in Prisma Access Discussions

Upgrade to PAN OS 10.0

Re: Upgrade to PAN OS 10.0