SAML ADFS for GlobalProtect

Kashif_Noor — Fri, 18 Aug 2017 15:42:20 GMT

Hi,

Is someone able to shed some ligh on the below.

1. Can SAML be used to map to an LDAP group, if so is there guidance?
2. Does PAN support using SAML AND prelogon/alwayson with GP?

Thanks

Re: SAML ADFS for GlobalProtect

jdelio — Mon, 21 Aug 2017 16:51:59 GMT

This question was posted in the wrong area.

I am moving this to the General Discussion area.

Remo — Mon, 21 Aug 2017 18:13:05 GMT

Why don't you just try this to see if it works? Because I would be interested too 😉

But now something hopefully more helpful:

As it is also possible with RADIUS, I assume that it will also work with SAML. But it's more a two way communication. One part is to have your firewall connecting to your LDAP directory to get the group mappings and also to be able to use LDAP groups in your policy or in your global protect gateway. If you there configured SAML as authentication, your IdP will tell the firewall which user just logged in and the firewall is able to check to what synchronized groups this user belongs to
For pre-logon you can only use a certificate profile, because at that stage the certificate is the only thing which is available without user-interaction. But SAML can then be used afterwards for userlogin, as described somehow in point 1 to apply user/group based policies/configurations.