topic Re: Global Protect - SAML Authentication Complete Page in General Topics

Global Protect - SAML Authentication Complete Page

JakeHarris — Mon, 03 May 2021 19:58:12 GMT

We're testing upgrading to version 2.5.x and have run into a few changes with the new features.

We enabled "Use Default Browser for SAML Authentication", because you know ie, is going away. After doing this, each time our end user authenticates, they receive an "Authentication Complete" Page, with a cryptic message about opening Global Protect and a link that doesn't work. It comes from https://<VPNGatewayFQDN>/SAML20/SP/ACS

I've searched through documentation and can't seem to find anything about it, nor is it present as a response page you can customize.

Ideally we'd prefer the old behavior, close the browser window / tab that was used for the SAML authentication, but minimally, we need to reword this page so it doesn't confuse users.. Maybe use it as a banner.

This is not the "Global Protect App Welcome Page", that feature is disabled.

Any help would really be appreciated.

Re: Global Protect - SAML Authentication Complete Page

S.Cantwell — Sat, 15 May 2021 15:05:29 GMT

Sounds like a feature request to me.

You would best contact your PANW SE for them to create a FR ticket.

Good luck!

Re: Global Protect - SAML Authentication Complete Page

Remo — Sun, 16 May 2021 17:34:44 GMT

@JakeHarris and after you get a FR ID from your SE, post it here, so others can also vote for it.

Re: Global Protect - SAML Authentication Complete Page

mike_yand — Mon, 16 Aug 2021 11:50:57 GMT

FR ID: 18254

Let the voting begins!

Re: Global Protect - SAML Authentication Complete Page

SRamsey — Wed, 24 May 2023 17:25:49 GMT

Same issue. I would like to customize this page.

Re: Global Protect - SAML Authentication Complete Page

fnolting — Wed, 31 Jan 2024 00:12:13 GMT

I'd like to vote for this feature request but I couldn't find where to do that.

Re: Global Protect - SAML Authentication Complete Page

NielsenStassyns — Mon, 29 Apr 2024 10:44:59 GMT

Me too... have you found were to vote or do we need to do this via a Palo Alto SE?

Re: Global Protect - SAML Authentication Complete Page

TechnicianTech — Wed, 01 May 2024 19:23:52 GMT

Same thing here!

Re: Global Protect - SAML Authentication Complete Page

Brandon_Wertz — Thu, 02 May 2024 15:15:50 GMT

@JakeHarris wrote:

We're testing upgrading to version 2.5.x and have run into a few changes with the new features.

We enabled "Use Default Browser for SAML Authentication", because you know ie, is going away. After doing this, each time our end user authenticates, they receive an "Authentication Complete" Page, with a cryptic message about opening Global Protect and a link that doesn't work. It comes from https://<VPNGatewayFQDN>/SAML20/SP/ACS

I've searched through documentation and can't seem to find anything about it, nor is it present as a response page you can customize.

Ideally we'd prefer the old behavior, close the browser window / tab that was used for the SAML authentication, but minimally, we need to reword this page so it doesn't confuse users.. Maybe use it as a banner.

This is not the "Global Protect App Welcome Page", that feature is disabled.

Any help would really be appreciated.

(I know this is an old thread)

This isn't going to answer your issue, but you're using "default browser because IE was going away. My company recently ran into this issue.

We use "embedded browser" for SAML auth to Azure AD (Through CIE) for GP. This wasn't working because the Global Protect software called "Webview" which essentially calls the legacy IE integration for browser authentication. Webview/IE doesn't support TLS1.3 so we would intermittently get authention failures to GP because of this incompatibility.

Coming in GP client version 6.0.10, I'm not sure about other client version, the GP software will call "Webview2" which calls the "Edge" version to the OS browser. This call to "Webview2" will support TLS1.3 and will allow the use of the "embedded browser" within the GP client.

Re: Global Protect - SAML Authentication Complete Page

tsfdye — Fri, 07 Jun 2024 03:05:28 GMT

Under default browser, how can we configure to automatically close the Authentication Complete Page? This is very annoying for end users who have to do this on a daily basis.