topic Re: Extended SSO Support for GlobalProtect Agents in General Topics

Extended SSO Support for GlobalProtect Agents

Hithead — Thu, 25 Sep 2014 07:48:27 GMT

Hi,

GP 2.1.0 is now released with the extended SSO support:

With Single Sign-On (SSO), the GlobalProtect agent wraps the user’s Windows login credentials to automatically authenticate and connect to the GlobalProtect portal and gateway. SSO has been enhanced in this release to so that when a third-party credential provider is being used to wrap the user’s Windows login credentials, the GlobalProtect agent wraps the third-party credentials to allow for successful authentication for the Windows user. This extended SSO functionality is supported on Windows 7 and Windows Vista clients.

Which third-party credential providers are supported?

We are using the SafeNet eToken solution. Our clients doesn't know their windows credentials, they authenticate with their eToken to login in windows. I really hope, that GP 2.1.0 will help us to use SSO with our SafeNet eToken solution...

Re: Extended SSO Support for GlobalProtect Agents

HULK — Thu, 25 Sep 2014 08:23:07 GMT

Hello Hithead,

I don't think there is a specific vendor list available at this point, rather it will work with all vendors. Actually, It will push the registry key with string value of that third-party credential provider inside Global-Protect registry entry to wrap the configured credential provider instead of the default windows credentials.

Registry Setting when Deploying GlobalProtect Client with Microsoft Group Policy Object

You may also contact with your PAN SE to get more detail information on this.

Thanks

Re: Extended SSO Support for GlobalProtect Agents

Hithead — Wed, 01 Oct 2014 07:30:43 GMT

Hi,

the related documents don't tell me the regkeys for the new function.

Also I test it now several times and it doesn't work. No new regkeys are installed.

Is there any manual available?

Re: Extended SSO Support for GlobalProtect Agents

Hithead — Tue, 28 Oct 2014 09:29:35 GMT

finally, the new admin guide is out GlobalProtect Administrator's Guide 6.1 (English)

the RegKey is

wrap-cp-guid

and

filter-non-gpcp

will try it and report the results

Re: Extended SSO Support for GlobalProtect Agents

Hithead — Tue, 28 Oct 2014 12:59:07 GMT

set up the key wrap-cp-guid with the value {8BF9A910-A8FF-457F-999F-A5CA10B4A885}, but the GP tile is not displaying at windows logon...

Re: Extended SSO Support for GlobalProtect Agents

Hithead — Wed, 29 Oct 2014 07:37:12 GMT

Update: The documentation was not correct. It will be updated soon...