topic Re: ADFS SAML Configuration in General Topics

ADFS SAML Configuration

benjaminsutter — Sat, 25 Feb 2017 02:54:31 GMT

Hi all

I need help to configure ADFS SAML with global-protect.

i have successfully imported the metadata.xml from adfs into palo.

But now i can't export the metadata from paloalto.

Whats the correct identifiers and endpoints urls for global-contect clientless? I have no idea, what i must configure in adfs.

Can anyone help?

I use panos 8.0

regards

Benjamin

Re: ADFS SAML Configuration

benjaminsutter — Tue, 28 Feb 2017 14:23:56 GMT

I solved the issue with the cli and now i have a connection from adfs to palo. But i can't login with adfs to palo alto. Has anyone experience with adfs -> saml palo alto?
i don't know what username attribute i must use for saml.

I created this rule in the adfs:

Palo Alto Saml Profile:

Could anyone help me?

Regards

Benjamin

Re: ADFS SAML Configuration

OtakarKlier — Tue, 28 Feb 2017 23:54:26 GMT

Hello,

While I have not set this up before, I am familiure with ldap. For the User attriobute, have you tried sAMAccountName?

Regards,

Re: ADFS SAML Configuration

benjaminsutter — Wed, 01 Mar 2017 08:18:59 GMT

Yes, i tested with sAMAccountName but it doesn't work. Login failed.

Re: ADFS SAML Configuration

OtakarKlier — Wed, 01 Mar 2017 19:56:27 GMT

If you havent already, I would recommend opening a support ticket.

Re: ADFS SAML Configuration

benjaminsutter — Thu, 02 Mar 2017 08:26:47 GMT

Yes, i think i must open a ticket for this case. Thanks for your help.

Re: ADFS SAML Configuration

asilliker — Fri, 10 Mar 2017 22:50:04 GMT

Looking at the transforms in ADFS that are populating your SAML Response, you probably want to use NameID as the username attribute in your configuration on the PAN-OS side.

Re: ADFS SAML Configuration

Malcolm_Garrett — Thu, 16 Mar 2017 05:19:26 GMT

Hi Benjamin,

Did you ever get this sorted out. What was the trick?

Regards, Malcolm

Re: ADFS SAML Configuration

benjaminsutter — Mon, 03 Apr 2017 13:38:36 GMT

Hi Malcolm

No, it doesn't work.

I will spend more time in this task in 2-3 weeks.

It's not a high prio task for us.

regards, Benjamin

Re: ADFS SAML Configuration

big_Gilo — Tue, 26 Sep 2017 14:46:16 GMT

Hi @benjaminsutter,

i would please like to know whether you were able to solve this problem

as am now facing the same Issue with SAML and AD FS (Login Retry)

I think the piece that is actually missing are Username Attribute and User group Attribute.

What parameters did you use for Username Attribute and User group Attribute?

I will deeply appreciate any hints on this matter.

kind regards,

Gilo

Re: ADFS SAML Configuration

rcknight — Tue, 24 Oct 2017 13:55:21 GMT

I just recently was able to get GP to authenticate to ADFS using SAML with the help of support. Here are some hints that worked for me.

1. GP 4.0.3 has a bug, so I needed to use either GP 4.0.2 or GP 4.0.4

2. ADFS is configured with a Custom Claim Rule, a Transform rule to map SessionID to NameID (using transient identifier) and another Transform rule to map Windows Account Name to username

3. username is used for Username Attribute in the SAML auth profile

Let me know if that helps you.

Ian

Re: ADFS SAML Configuration

Retired Member — Fri, 03 Nov 2017 08:45:13 GMT

Hi,

can you add a screenshot of your rules?

Thanks

Re: ADFS SAML Configuration

Retired Member — Sat, 11 Nov 2017 05:55:09 GMT

After a lot of trying I'm at the point that I can login via SAML to global protect. I'm using three rules in ADFS configuration:

1. Rule:

c1:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]
 && c2:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant"]
 => add(store = "_OpaqueIdStore", types = ("http://mycompany/internal/sessionid"), query = "{0};{1};{2};{3};{4}", param = "useEntropy", param = c1.Value, param = c1.OriginalIssuer, param = "", param = c2.Value);

2. Rule:

3. Rule:

I use sAMAccountName instead of username in my Authentication Profile.

For just logon to global protect via SAML that seems ok.

But I want to use Clientless VPN with apps that also do a SAML authentication. At the moment the situation is the following:

I open the global protect portal and get redirected to the ADFS logon site (external Form authentication). I logon and get redirected to the Clientless VPN portal.

Then I click on one app which also uses SAML authentication. I expect that the app will just open because I'm already authenticated via SAML BUT I get another ADFS authentication window (internal Windows Authentication) and have to logon again.

When I then open another app from clientless vpn portal then this works via SSO.

I think that happens because ADFS cannot map my session after I'm authenticated to the global protect portal so I think there is still missing something in the configuration of the rules.

(Another information: I had to delete encryption and signature info in ADFS for the Clientless VPN party. I don't know why but I will check this later.

)

Any ideas?

Thanks!

Re: ADFS SAML Configuration

rcknight — Mon, 13 Nov 2017 14:42:40 GMT

I'm sorry, but I don't have any ideas for use with clientless vpn. I've only been focusing on GP. Right now I'm working through issues with the signing certificate verification and the signing of SAML requests to the iDP. Maybe my eventual findings here might help you with your last comment.

Re: ADFS SAML Configuration

Retired Member — Mon, 13 Nov 2017 14:45:47 GMT

But can you add screenshots of your ADFS rules?

Thanks!

Re: ADFS SAML Configuration

rcknight — Mon, 13 Nov 2017 15:17:08 GMT

Custom Claim RuleTransform Name IDTransform accountname