topic Azure SAML authentication not Happened via GP Agent in General Topics

Azure SAML authentication not Happened via GP Agent

AhamadullahM — Mon, 18 Sep 2023 09:05:52 GMT

Hi All,

We have implemented the SAML two-factor authentication for Global Protect users.

We have tested via browser for SAML authentication, and the page successfully redirected to the Microsoft sign-in authentication page. After signing in, the Two-Factor Verification process was initiated, and access to the global protect portal was granted upon successful completion.

However, when attempting SAML authentication via the global protect agent, the Microsoft sign-in page and Two-Factor Verification prompt were not displayed, and the agent connected directly.

Kindly help to resolve the issue.

Re: Azure SAML authentication not Happened via GP Agent

aleksandar.astardzhiev — Mon, 18 Sep 2023 11:09:55 GMT

Hi @AhamadullahM ,

Just to clarify - you don't see GP internal browser pop-up at all, or it just pop-up, but closes immediately without prompting for creds.

Are you using authentication override cookies - https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-user-authentication/how-does-the-app-know-what-credentials-to-supply/cookie-authentication-on-the-portal-or-gateway

How long lifetime are you using?

Re: Azure SAML authentication not Happened via GP Agent

AhamadullahM — Mon, 18 Sep 2023 11:42:58 GMT

Thanks for your input,

When I entered the portal address in the gp agent after it did not prompt any Microsoft sign-in page. after a few seconds, it shows the GP connected. When I verified the system logs the auth profile is getting SAML profile only. But why its skipped the sign-in and two-factor verification page?

I have verified the configuration. I have not enabled the authentication cookies.