topic Re: Can Use Okta SAML for GP- "Prelogon Then On-Demand" connectio in General Topics

Can Use Okta SAML for GP- "Prelogon Then On-Demand" connection method

Sethupathi — Thu, 02 Jul 2020 16:20:30 GMT

Hi Team,

We tried to implement the OKTA SAML authentication method for GP in our organization.

Does Global Protect - "Prelogon Then On-Demand" connection method supports Okta SAML for authentication (MFA).?

If not what is a recommended GP connection method to use Okta SAML authentication.

Could you please help us here! I tried all resources I didn't got an answer..!!

Regards,

Sethupathi M

Re: Can Use Okta SAML for GP- "Prelogon Then On-Demand" connectio

Remo — Thu, 02 Jul 2020 20:28:32 GMT

Hi @Sethupathi

Having GP authentication working with the different connection methods strongly depends on the GP agent version you are using. With which version do you try this configuration and also which PAN-OS version do you have installed on the firewall?

Btw. I assume you already know about this critical vulnerability: https://security.paloaltonetworks.com/CVE-2020-2021

So make sure you use either one of the PAN-OS versions that are fixed or enable the option "Validate Identity Provider Certificate".

Regards,

Remo

Re: Can Use Okta SAML for GP- "Prelogon Then On-Demand" connectio

MP18 — Fri, 03 Jul 2020 17:44:58 GMT

@Sethupathi

We have configured GP Pre log on Machine cert based Authentication and then we added Authentication Profile using SAML in Azure.

To config OKTA for SAML please follow this link'

https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Palo-Alto-Networks-GlobalProtect.html

Regards