Captive portal auth with Client Certificate as first auth method and local auth as fallback

[karimanizer]

Hello team, 

To identify my users, I have used Captive Portal with ldap authentication profile.

Then I removed the ldap from the captive protal config and added a "Certificate profile", and it works well as well.

However, when I assign both an ldap profile AND a certificate profile to my captive portal configuration (Device> User Identification> Captive Portal settings), the paloalto first ask me to provide a client certificat then it allways prompt me for username/ password .... which is not something I want.

My question is the following, is there a way to configure to paloalto so that if the client certificate authentication succeed then it doesn't prompt us for username/password. And if the client certificat authentication fails then it does prompt us for username password. 

I'm in lab environment and I can show my config, 

Many thanks for your help

karim benyelloul

[karimanizer]

anyone ? 😞 

[reaper]

Client certificates are a strict authentication method that it is part of the handshake whereas username/password happen after a connection is established

It is inefficient to first establish a session that requires a client certificate, to then restart a new session that doesn't require a client certificate

[Chacko42]

Dear @karimanizer,

"You don’t need an authentication profile or sequence for client certificate authentication. If
you configure both an authentication profile/sequence and certificate authentication, users
must authenticate using both."

Admin Guide 8.1 page 466

So it's expected behavior to have both validated

[karimanizer]

Hi @reaper ,

Thanks for your reply, 

      | It is inefficient to first establish a session that requires a client certificate, to then restart a new session that doesn't require a client certificate 

This is not what I was expecting to happen. For me client certificate authentication is a relyable authenticate method by itself, and the firewall does not need to ask the user to enter its username/password to validate its identity.

The senario I was expecting looks like this: 

if { client_certificate auth is sucessful } 
      get the username from the certificat and map it to its IP adress. 
else
      prompt the user to enter username/password.

Is it because the firewall sees it as a different authentication factor "something the user have" ? instead of the username/password which are "something the user know"?

many thanks,