Captive portal auth with Client Certificate as first auth method and local auth as fallback

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Captive portal auth with Client Certificate as first auth method and local auth as fallback

L2 Linker

Hello team, 


To identify my users, I have used Captive Portal with ldap authentication profile.

Then I removed the ldap from the captive protal config and added a "Certificate profile", and it works well as well.


However, when I assign both an ldap profile AND a certificate profile to my captive portal configuration (Device> User Identification> Captive Portal settings), the paloalto first ask me to provide a client certificat then it allways prompt me for username/ password .... which is not something I want.


My question is the following, is there a way to configure to paloalto so that if the client certificate authentication succeed then it doesn't prompt us for username/password. And if the client certificat authentication fails then it does prompt us for username password. 


I'm in lab environment and I can show my config, 

Many thanks for your help

karim benyelloul


This is not what I was expecting to happen. For me client certificate authentication is a relyable authenticate method by itself, and the firewall does not need to ask the user to enter its username/password to validate its identity.

this is correct, you do not need to add an additional username and password after the clienbt cert is validated, but you can as an additional form of authentication


The senario I was expecting looks like this: 

if { client_certificate auth is sucessful } 
      get the username from the certificat and map it to its IP adress. 
      prompt the user to enter username/password.

Is it because the firewall sees it as a different authentication factor "something the user have" ? instead of the username/password which are "something the user know"?

well, no

The delivery mechanism for these 2 forms of authentication is completely different

the client certificate is exchanged as part of the ssl handshake (layer 6) while the username/password is essentially a web form (layer7)

You can't get to layer 7 whithout passing through layer6, this is why a client certificate can't be an OR condition, but authentication methods (ldap, kerberos, radius,..) can

Tom Piens
PANgurus - (co)managed services and consultancy

To touch back on this subject, in the GlobalProtect agent (because it is a piece of software), you DO have this option

In case you really need this :



Tom Piens
PANgurus - (co)managed services and consultancy

Many thanks!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!