Captive portal auth with Client Certificate as first auth method and local auth as fallback

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Captive portal auth with Client Certificate as first auth method and local auth as fallback

L2 Linker

Hello team, 

 

To identify my users, I have used Captive Portal with ldap authentication profile.

Then I removed the ldap from the captive protal config and added a "Certificate profile", and it works well as well.

 

However, when I assign both an ldap profile AND a certificate profile to my captive portal configuration (Device> User Identification> Captive Portal settings), the paloalto first ask me to provide a client certificat then it allways prompt me for username/ password .... which is not something I want.

 

My question is the following, is there a way to configure to paloalto so that if the client certificate authentication succeed then it doesn't prompt us for username/password. And if the client certificat authentication fails then it does prompt us for username password. 

 

I'm in lab environment and I can show my config, 

Many thanks for your help

karim benyelloul

7 REPLIES 7

L2 Linker

anyone ? 😞 

Cyber Elite
Cyber Elite

Client certificates are a strict authentication method that it is part of the handshake whereas username/password happen after a connection is established

 

It is inefficient to first establish a session that requires a client certificate, to then restart a new session that doesn't require a client certificate

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Dear @karimanizer,

"You don’t need an authentication profile or sequence for client certificate authentication. If
you configure both an authentication profile/sequence and certificate authentication, users
must authenticate using both."

Admin Guide 8.1 page 466

 

So it's expected behavior to have both validated

Best Regards
Chacko

Hi @reaper ,

Thanks for your reply, 

 

      | It is inefficient to first establish a session that requires a client certificate, to then restart a new session that doesn't require a client certificate 


This is not what I was expecting to happen. For me client certificate authentication is a relyable authenticate method by itself, and the firewall does not need to ask the user to enter its username/password to validate its identity.

 

The senario I was expecting looks like this: 

if { client_certificate auth is sucessful } 
      get the username from the certificat and map it to its IP adress. 
else
      prompt the user to enter username/password.

Is it because the firewall sees it as a different authentication factor "something the user have" ? instead of the username/password which are "something the user know"?

 

many thanks,


This is not what I was expecting to happen. For me client certificate authentication is a relyable authenticate method by itself, and the firewall does not need to ask the user to enter its username/password to validate its identity.

this is correct, you do not need to add an additional username and password after the clienbt cert is validated, but you can as an additional form of authentication

 

The senario I was expecting looks like this: 

if { client_certificate auth is sucessful } 
      get the username from the certificat and map it to its IP adress. 
else
      prompt the user to enter username/password.

Is it because the firewall sees it as a different authentication factor "something the user have" ? instead of the username/password which are "something the user know"?


well, no

The delivery mechanism for these 2 forms of authentication is completely different

the client certificate is exchanged as part of the ssl handshake (layer 6) while the username/password is essentially a web form (layer7)

You can't get to layer 7 whithout passing through layer6, this is why a client certificate can't be an OR condition, but authentication methods (ldap, kerberos, radius,..) can

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

To touch back on this subject, in the GlobalProtect agent (because it is a piece of software), you DO have this option

In case you really need this :

 

GPauth.png

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Many thanks!

  • 5111 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!