Cloud Identity Engine for On-Premises Global Protect

[OwenFuller]

Has anyone used the Cloud Identity Engine for authentication for an on-prem Global Protect portal/gateway?

I'm experimenting with the CIE. It works great for admin login to the GUI, but I'm trying to set it up as an auth source for GP. It is working just fine on the portal for web browser auth (i.e. to download the agent), but I'm getting authentication failures when I try to login w/ the agent itself. The browser will open, and redirect to Okta. However, after redirecting back to the firewall, I get a message saying "Authentication failed. Please click the button below to relaunch authentication." The retry button takes me back through a similar flow, and then I ultimately get a message that says "Authentication Failed. Please contact the administrator for further assistance. Error code: 0."

[Parsek]

Hi OwenFuller,

Did you solve this problem?

Because I got the same alarm "Authentication Failed. Please contact the administrator for further assistance. Error code: 0."

We use GP and google idp.

[Maxstr]

I'm also getting this error with Azure, even though the connection is successful. When connecting with GP to our firewall, the first browser window that pops up with Azure MFA. I log in, then another browser pops up and displays the "Authentication Failed: please contact the administrator" message (at the URL https://[my-firewall]/SAML20/SP/ACS )

Clicking "Login Retry" causes it to open another browser window with the message "When you see the dialog on the browser, click Open GlobalProtect. If the dialog does not appear, click here to launch GlobalProtect." Then when I click to that link to launch it, it successfully connects.

On the firewall itself, there are no error logs and the Cloud Identity Engine logs all say Successful.

PAN-OS: 10.1.5-h2
GlobalProtect Agent: 6.0.1

[OwenFuller]

I still have an active TAC case open. More troubleshooting on Monday.

[emyl_79]

Did you find a solution with TAC? Having the same identical issue...

[OwenFuller]

Case still open. Last troubleshooting session was yesterday. Not much progress though, in my opinion.

[emyl_79]

I've made some tests in my lab, it looks like it's actually working on PAN-OS 10.2.2-h1 and not on 10.1.6...

[OwenFuller]

Well that's good to know. Unfortunate, but good to know. I'll pass this along to TAC.

[DuncanSmith]

Any update on this? We're getting the same issue.

[Jon_Woloshyn]

I was struggling to get this working both on-prem and with Prisma Access and was getting the same error message. Turns out you have to enable Use Default Browser for SAML in the App settings on the GP portal. Started working properly for me after that.

[OwenFuller]

That's what they told me to do as well, but it's already enabled. Still broken. About to give up on this, and just close my TAC case.

[JuanTraverso]

Owen, were you finally able to make this work? We have the same issue.