Palo Alto admin UI single sign on with Okta

Kathiravan_R — Tue, 08 Feb 2022 06:40:43 GMT

Configured the Panorama SAML authentication for Admin UI SSO integration with Okta.

I followed the Okta/Palo Alto single sign on setup instruction. Here SP(Palo Alto) will initiate the SSO and Okta will acts as an IDP.

Issue:

I am able to login to Panorama after the successful SSO but frequently getting the "Empty SSO Relaystate".

Is there anything I have to tune from the Panorama? Please advise.

Re: Palo Alto admin UI single sign on with Okta

S.Cantwell — Tue, 08 Feb 2022 15:46:06 GMT

Recommend that you confirm this message is sent by the OKTA, and received by the Panorama.

Or, it could be generated internally by the Panorama, which I would recommend a TAC case for tshooting.