topic Single Sign on configuration in General Topics

Single Sign on configuration

sabirHussain — Sun, 27 Jan 2019 09:10:22 GMT

HI every one ,

any one help me to configure signle sign on in palo alto . as per my expirence we use to have agent in fortinet for sso. but in palo alto, i never configure SSO before and i,m not able to find any SSO Step by step,

We have Active directory Envirement and Palo Alto 3220 HA .

any link or video

Re: Single Sign on configuration

Remo — Sun, 27 Jan 2019 17:26:26 GMT

Hi @sabirHussain

What you are searching for on Paloalto Firewalls is simply called "User-ID" and the corresponding part to Fortinet FSSO is done with User-ID Agents. This agent can either be configured directly on the firewall or on a windows server and queries the Active Directory Servers, Exchange Servers or File/Peintservers for logginevent to get a User-IP-Mapping and to enable user based policies without bothering the users with an additional login.

On this documentation website you can find some informations: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id.html

Or a tutorial video here: https://youtu.be/NYAYjvNpSu0

And an article from the getting started series here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRyCAK

Regards,

Remo

Re: Single Sign on configuration

sabirHussain — Sat, 02 Feb 2019 14:08:12 GMT

hi @Remo

Thanks for your reply . now i configured LDAp and User ID agent on my domain . and all working fine but i am facing issue

i am trying to use authentication policy (captival Portal for non domain users) but after applying web-form authentication policy all users are getting captival portal page even they are domain users,

also if i configure browser challenge . all user can browse with out captival portal include domain and non domain

please help .

Re: Single Sign on configuration

Remo — Sat, 02 Feb 2019 16:19:31 GMT

Hi @sabirHussain

Did you verify if the IP-user-mappings are present on the firewall? If you can answer this with yes, did you configure the authentication policy rule for any user or only for unknown users?