GlobalProtect and multiple AAD tenants

RobertShawver — Fri, 09 Jun 2023 19:09:37 GMT

Hello -

We've set up a GlobalProtect portal and gateway to connect third-party individuals to our VPN. We've configured it to use SAML for authentication, leveraging an Azure Active Directory Enterprise Application that we have configured per the Microsoft guide (https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/palo-alto-networks-globalprotect-tutorial). The third-party user is expected to connect to our VPN portal, be redirected to the SAML logon page, and then utilize our company credentials to log onto our VPN.

The issue that we are running into is that these third-party users have their own AAD tenants and the logon prompt is attempting to use their tenant's logon information. Instead of prompting the user to enter their @Company.com account and password, it is automatically attempting to log in using their @vendor.com account.

For web-based applications, we usually avoid this problem by opening up an incognito window and going through the logon process. However, GlobalProtect controls the browser pop-up and is using the default browser in non-incognito mode.

How can we either (a) get GlobalProtect to open the logon prompt using an incognito window or (b) prevent the SAML authentication prompt from automatically using the @vendor.com account?

We have been using the workaround of having the vendor logout of their M365 on everything on their device, but this has been causing other issues and is not a viable workaround long-term.

Adding the @vendor.com accounts as guests to our AAD tenant is not a viable process as these user's may only need one time access during a firefighter scenario, and adding the guest and then propagating groups will be too complicated. Likewise, whatever authentication mechanism we use must continue to support MFA via AAD.

Re: GlobalProtect and multiple AAD tenants

reaper — Mon, 12 Jun 2023 07:49:25 GMT

Did you explicitly configure GP to launch the default browser? Try using the embedded one instead. In all my deployments, my users are being asked which of their accounts they want to use (Azure as IdP), I use the embedded browser

Re: GlobalProtect and multiple AAD tenants

RobertShawver — Mon, 12 Jun 2023 16:07:57 GMT

Thank you Sir, do you have instructions or can point me to instructions on how to do this? "Did you explicitly configure GP to launch the default browser?"

Re: GlobalProtect and multiple AAD tenants

S.Cantwell — Mon, 12 Jun 2023 16:27:00 GMT

The configuration is within the Portal Agent section.

Re: GlobalProtect and multiple AAD tenants

RobertShawver — Mon, 12 Jun 2023 16:34:50 GMT

Mine is set to "No".

PAN-OS 10.1.9-h3

GlobalProtect App Version 6.0.5-30

topic Re: GlobalProtect and multiple AAD tenants in General Topics

GlobalProtect and multiple AAD tenants

Re: GlobalProtect and multiple AAD tenants

Re: GlobalProtect and multiple AAD tenants

Re: GlobalProtect and multiple AAD tenants

Re: GlobalProtect and multiple AAD tenants