ADFS SAML Configuration

[benjaminsutter]

Hi all

I need help to configure ADFS SAML with global-protect.

i have successfully imported the metadata.xml from adfs into palo.

But now i can't export the metadata from paloalto. 

Whats the correct identifiers and endpoints urls for global-contect clientless? I have no idea, what i must configure in adfs. 

Can anyone help?

I use panos 8.0

regards

Benjamin

[benjaminsutter]

I solved the issue with the cli and now i have a connection from adfs to palo. But i can't login with adfs to palo alto. Has anyone experience with adfs -> saml palo alto?
i don't know what username attribute i must use for saml.

I created this rule in the adfs:

Palo Alto Saml Profile:

Could anyone help me?

Regards

Benjamin

[OtakarKlier]

Hello,

While I have not set this up before, I am familiure with ldap. For the User attriobute, have you tried sAMAccountName?

Regards,

[benjaminsutter]

Yes, i tested with sAMAccountName but it doesn't work. Login failed.

[OtakarKlier]

If you havent already, I would recommend opening a support ticket.

[benjaminsutter]

Yes, i think i must open a ticket for this case. Thanks for your help.

[asilliker]

Looking at the transforms in ADFS that are populating your SAML Response, you probably want to use NameID as the username attribute in your configuration on the PAN-OS side. 

[Malcolm_Garrett]

Hi Benjamin,

Did you ever get this sorted out.   What was the trick?

Regards, Malcolm

[benjaminsutter]

Hi Malcolm

No, it doesn't work. 

I will spend more time in this task in 2-3 weeks.

It's not a high prio task for us. 

regards, Benjamin

[big_Gilo]

Hi @benjaminsutter, 

i would please like to know whether you were able to solve this problem

as am now facing the same Issue with SAML and AD FS (Login Retry)

I think the piece that is actually missing are Username Attribute and User group Attribute.

What parameters did you use for Username Attribute and User group Attribute?

I will deeply appreciate any hints on this matter.

kind regards,

Gilo