GlobalProtect Mobile Initial SAML Authentication with ID Fails After Upgrading to PAN-OS 10.2.18-h6

Fariq_Zaidi — Tue, 11 Aug 2026 03:21:58 GMT

Hi ,

Observed Behavior
- Before upgrading to PAN-OS 10.2.18-h1, GlobalProtect SAML authentication using ID worked normally on all platforms.
- After upgrading to PAN-OS 10.2.18-h6, only Android, iPhone, and iPad are affected.
- Initial SAML authentication fails only on mobile clients.
- Windows clients continue to authenticate successfully using the same SAML configuration.
- Android displays net::ERR_UNKNOWN_URL_SCHEME.
- iOS displays Unsupported URL.
- As a workaround, users must first log in using the local username/password authentication profile. Once the initial local authentication is completed, subsequent logins using ID SAML authentication are successful.

- The issue started immediately after upgrading from PAN-OS 10.2.18-h1 to PAN-OS 10.2.18-h6.

Expected Behavior
GlobalProtect Mobile clients should be able to complete the initial SAML authentication using ThaiID successfully, without requiring a prior local authentication.

Request : Could you please help verify
1. Whether this is a known issue or regression introduced in PAN-OS 10.2.18-h6.
2. Whether any changes were made to the GlobalProtect Mobile initial SAML authentication flow in this release.
3. Whether there are any known issues related to mobile session initialization, portal session/cookie handling, or callback URL processing after upgrading to PAN-OS 10.2.18-h6.
4. Whether any workaround, configuration changes, or hotfix is available.

topic GlobalProtect Mobile Initial SAML Authentication with ID Fails After Upgrading to PAN-OS 10.2.18-h6 in General Topics

GlobalProtect Mobile Initial SAML Authentication with ID Fails After Upgrading to PAN-OS 10.2.18-h6