topic Re: Global Protect need to ask for password all time we connect in General Topics

Global Protect need to ask for password all time we connect

BigPalo — Wed, 29 Nov 2023 09:37:46 GMT

Hi,

We have configured GP with CISCO DUO. If i connect in a fisrt moment to GP is successfull. But if i disconnect and connect again the credentials are not being asked. Its like there is a cache that GP is saving my credentials and DFA for a momento. How can i configure that always i connect to GP the password is asked and DFA. If its possible saving the username field. Where is this configured?. thanks

Re: Global Protect need to ask for password all time we connect

reaper — Wed, 29 Nov 2023 10:11:05 GMT

first, go and check if you have authentication cookie enabled on the gateway Network > globalprtoect > gateways > agent > client settings > authentication override

also check if the conditional access configuration of DUO is set to. 'every time' as it may be allowing a grace period where a SAML token is accepted

Re: Global Protect need to ask for password all time we connect

BigPalo — Wed, 29 Nov 2023 11:23:06 GMT

Yes, i have enabled both options:

-Generate cooki for auth override.

-Accept cookie for auth override.

I configured 8 hours.

So that means that the credentials will be cached for 8 hours? how can i configure that always users connect GP need introduce password and DUO token?

thanks

Re: Global Protect need to ask for password all time we connect

reaper — Wed, 29 Nov 2023 11:38:34 GMT

no, this setting gives out a cookie thats valid for 8 hours. That cookie will be used to authenticate instead of your regular authentication mechanism for the duration you configured (8 hours)

if you disable "accept cookie for auth override" for the gateway, your users will always be prompted to authenticate via DUO

Re: Global Protect need to ask for password all time we connect

BigPalo — Wed, 29 Nov 2023 12:15:15 GMT

OK, so this config would not solve my main issue.

How can i do for user always need to add the password and token when they disconnect from GP. I did a test changing GATEWAY->AGENT-> Save credential -> save only username but the result is the same. After a succesful connection keeps the credentials and token for next time.

Re: Global Protect need to ask for password all time we connect

reaper — Thu, 30 Nov 2023 13:32:20 GMT

you can switch to SAML. in this case there is no notion of locally stored credentials, you get a token from the IdP that is subject to conditional access

if conditional access is set to require re-authentication every time, you get taken to the login page via a browser