topic Re: Customize Authentication Complete URL in General Topics

Customize Authentication Complete URL

BigPalo — Thu, 26 Jun 2025 14:38:43 GMT

Hi,

i would like to customize the URL Authentication complete in GP. i was checking this KB: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-user-authentication/set-up-external-authentication/set-up-saml-authentication/customizing-the-saml-cas-acs-landing-page

The problem is that we dont have the option: auth-response-page in the command.

set global-protect auth-response-page. We only have these options:

active)# set global-protect
> clientless-app Application accessed using clientless vpn
> clientless-app-group Group of applications accessed using clientless vpn
> dhcp-server-profile DHCP servers for GP users
> global-protect-gateway GlobalProtect gateway user related configuration
> global-protect-mdm GlobalProtect MDM server
> global-protect-portal GlobalProtect portal configuration
<Enter> Finish input

Our version is 11.1.6.

Someone has customized this URL and work the commands?

Re: Customize Authentication Complete URL

BPry — Thu, 26 Jun 2025 14:47:12 GMT

@BigPalo,

This isn't set in configuration mode, if you exit that the command should exist for you to set how you want.

Re: Customize Authentication Complete URL

BigPalo — Fri, 27 Jun 2025 09:42:14 GMT

In display mode is the same. Not "set global-protect auth-response-page" find un any mode.

(active)> set global-protect
> arg-maxlen Max string length of GlobalProtect request arguments supported
> global-protect-portal GlobalProtect portal configuration

> redirect redirect
> saml-domain Set GlobalProtect SAML domain
> satellite-serialnumberip-auth Satellite Serialnumber + IP auth configuration

Re: Customize Authentication Complete URL

BigPalo — Mon, 30 Jun 2025 05:39:26 GMT

Can someone check if this command exists "set global-protect auth-response-page" in the FW?

Re: Customize Authentication Complete URL

kiwi — Mon, 30 Jun 2025 12:16:53 GMT

Hi @BigPalo ,

The SAML20/SP/ACS customization feature was first introduced for future PAN-OS versions and was later backported to version 10.2.11. It has been available in the 10.2 OS code from version 10.2.11. Unfortunately, this feature is not available in versions 11.0, 11.1, or 11.2 as of now. I do not have information on when this will be available in these major versions.

Kind regards,

-Kim.

Re: Customize Authentication Complete URL

BigPalo — Tue, 01 Jul 2025 09:09:29 GMT

Many thanks Kiwi. Why is not available in 11.x 😞 ? So thats why PA doesnt recommend to customize that URL?

thanks

Re: Customize Authentication Complete URL

Brandon_Wertz — Tue, 01 Jul 2025 13:41:17 GMT

@BigPalo wrote:

Many thanks Kiwi. Why is not available in 11.x 😞 ? So thats why PA doesnt recommend to customize that URL?

thanks

I don't work for Palo, but there have been numerous CVEs relating to VPN portals in both Palo and Fortinet. With a lot of the Fortinet ones being super egregious. My guess is Palo made a tactical decision to remove the ability to modify the portal for security reasons to better harden the appliance. (Just a guess though.)