Kerberos SSO with Globalprotect and User-Logon

Chacko42 — Wed, 28 Mar 2018 19:17:26 GMT

Hi Community,

I have a strange problem with Kerberos SSO and Globalprotect 4.0.7:

I set up Kerberos SSO and the SSO is working.

If you connect to the Globalprotect-Portal via browser, you directly get a Kerberos ticket and the SSO works.

If you logout from Windows 10 and you login again, you have a Kerberos-Ticket assigned, but the global protect client doesn't automatically connect to the portal. The form data are already filled up with portal address and username - but the user-id is only shown on the PA, after manually clicking to connect.

Does anybody has an idea what the reason for this behavior might be?

Can anyone confirm, that my planned setup is working in general: User logs in to Windows, Global Protect automatically connects via Kerberos SSO with the internal gateway?

I'm looking forward to your feedback.

Re: Kerberos SSO with Globalprotect and User-Logon

Chacko42 — Thu, 05 Apr 2018 08:35:14 GMT

Hi,

I have an update regarding this issue:
For user identification, the DC server monitor was in use as well.
The SSO with kerberos works, but instantly after the login, the security log is read and the user-id entry gets overwritten.

I checked that by "show user ip-user-mapping all" and after the logon, the type was AD, not GP.

It seems we are to slow - anyway I would be happy if someone could confirm my finding.

Best Regards

Johannes

topic Kerberos SSO with Globalprotect and User-Logon in General Topics

Kerberos SSO with Globalprotect and User-Logon

Re: Kerberos SSO with Globalprotect and User-Logon