Captive portal auth with Client Certificate as first auth method and local auth as fallback

[karimanizer]

Hello team, 

To identify my users, I have used Captive Portal with ldap authentication profile.

Then I removed the ldap from the captive protal config and added a "Certificate profile", and it works well as well.

However, when I assign both an ldap profile AND a certificate profile to my captive portal configuration (Device> User Identification> Captive Portal settings), the paloalto first ask me to provide a client certificat then it allways prompt me for username/ password .... which is not something I want.

My question is the following, is there a way to configure to paloalto so that if the client certificate authentication succeed then it doesn't prompt us for username/password. And if the client certificat authentication fails then it does prompt us for username password. 

I'm in lab environment and I can show my config, 

Many thanks for your help

karim benyelloul

[reaper]

---

This is not what I was expecting to happen. For me client certificate authentication is a relyable authenticate method by itself, and the firewall does not need to ask the user to enter its username/password to validate its identity.

this is correct, you do not need to add an additional username and password after the clienbt cert is validated, but you can as an additional form of authentication

The senario I was expecting looks like this: 

if { client_certificate auth is sucessful } 
      get the username from the certificat and map it to its IP adress. 
else
      prompt the user to enter username/password.

Is it because the firewall sees it as a different authentication factor "something the user have" ? instead of the username/password which are "something the user know"?

---

well, no

The delivery mechanism for these 2 forms of authentication is completely different

the client certificate is exchanged as part of the ssl handshake (layer 6) while the username/password is essentially a web form (layer7)

You can't get to layer 7 whithout passing through layer6, this is why a client certificate can't be an OR condition, but authentication methods (ldap, kerberos, radius,..) can

[reaper]

To touch back on this subject, in the GlobalProtect agent (because it is a piece of software), you DO have this option

In case you really need this :

[karimanizer]

Many thanks!