Update on GlobalProtect's Embedded Web-Views With IE 11 Getting Deprecated by MSFT

[vathreya]

As of June 15, 2022, IE 11 is getting deprecated by Microsoft Edge. Customers are concerned about the use of embedded web-view within GlobalProtect (it relies on IE 11 SDK) well beyond June 15, 2022.

Palo Alto Networks’ GlobalProtect team has tested GlobalProtect’s features that require embedded web-view in 5.1.X, 5.2.X, and 6.0.X release trains.

Customers are advised to review the testing matrix to understand the impact of Microsoft deprecating IE 11 on GlobalProtect’s embedded web-views.

GlobalProtect Version	Windows Version	Use-Case Results
		SAML Authentication in User-logon/On-Demand mode	SAML Authentication in Connect Before Logon	Welcome Page	Help Page	Link in HIP Notification
5.1.X (5.1.11)	Windows 10	Opens in embedded web-view	N/A	Opens in embedded web-view	Opens in user selected default system browser	Opens in IE
5.1.X (5.1.11)	Windows 11 Home	Opens in embedded web-view	N/A	Opens in embedded web-view	Opens in user selected default system browser	Opens in Edge
5.2.X (5.2.12)	Windows 10	Opens in embedded web-view	Opens in embedded web-view	Opens in embedded web-view	Opens in user selected default system browser	Opens in IE
5.2.X (5.2.12)	Windows 11 Home	Opens in embedded web-view	Opens in embedded web-view	Opens in embedded web-view	Opens in user selected default system browser	Opens in Edge
6.0.X	Windows 10	Opens in embedded web-view	Opens in embedded web-view	Opens in user selected system default browser	Opens in user selected system default browser	Opens in IE
6.0.X	Windows 11 Home	Opens in embedded web-view	Opens in embedded web-view	Opens in user selected system default browser	Opens in user selected system default browser	Opens in Edge

Note: This April 2022 article from Microsoft, "Disable Internet Explorer 11," was used as a referenced.

[KengSeng]

After deprecated IE11, does Windows still support the "embedded web-view within GlobalProtect (it relies on IE 11 SDK)"?

If any of the SAML vendor rollout .js script that cannot be interpreted by the "embedded web-view (it relies on IE 11 SDK)" if the customer is using CBL (which not supported using Default Browser), how we are able to fix the issue?

[Ldxiang]

Hi, 

Was running into an issue with the CBL function when using the aws sso as my IDP for the globalprotect authentication. I raised a case to TAC, but was told that they are unable to do anything about this as the update by aws sso team that cause the issue was rolled back. Not sure if Palo alto can confirm that the CBL that is using IE11 SDK can work for all IDP or is this a time bomb that Palo alto is ok with for the customer suffer the consequence.

[William-Wu]

Please check new features for GP " Embedded Browser Framework Upgrade " as part of GP 6.2.3. (Released on 2024-04-10)

https://docs.paloaltonetworks.com/globalprotect/6-2/globalprotect-app-release-notes/features-introdu...

Starting with GlobalProtect 6.2.3, the embedded browser framework for SAML authentication has been upgraded to Microsoft Edge WebView2 (Windows) and WebKit (macOS). This provides a consistent experience between the embedded browser and the GlobalProtect client. WebView2 and WebKit are also compatible with FIDO2-based authentication methods. For more information, see the Microsoft Edge WebView2 documentation.

By default, tenants using SAML authentication are configured to utilize the embedded WebView2 (Windows) or WebKit (macOS) instead of relying on the system's default browser. With this enhancement, there's no need for end users to configure a SAML landing page, eliminating the necessity to manually close the browser. This streamlines the authentication process.

In a Microsoft entra-joined environment with SSO enabled, users are not required to enter their credentials in order to authenticate to Prisma Access using GlobalProtect. This seamless experience is true whether the user is logging in to their environment for the first time or whether they have logged in before. If there is an error during the authentication, it is displayed in the embedded browser. This authentication process works across all device states.

In a non entra-joined environment with SSO enabled, users must enter their credentials during the initial login. On subsequent logins, the credentials are auto-filled as long as the SAML identity provider (IdP) session is active and has not timed out.

GlobalProtect 

[J.Suarez358338]

Has anyone tested 6.2.3 and 6.2.4?  I've tested connectbeforelogon in a Windows Autopilot scenario and it doesn't work.  looking at the logs is still requesting IE rather than edge.