Chroomebooks and Transparent Authentication

[dannon]

We are a school district with 2-3,000 Chromebooks.

Currently, we have a Palo rule based upon subnet that applies correct filtering policy.  The problem is that we can't see which user is logged in, only the IP address.

Does anyone have a solution for this?

Does / Is Palo looking at something to correct this?

Thanks.

Dan

[BPry]

Someone actually made an extension that can be found here. I'm pretty sure that this isn't a project that PA supports however and I've never actually used it so I can't speak to how well/if it actually works. 

Offically I don't think that Palo actually has anything built out for chromebooks yet, part of the reason is likely that I don't think Google actually approves of people publishing extensions that pull user names for obvious reasons. 

[dannon]

Yeah,  I watched the webinar for that one and tried to set it up, but i couldn't get it working.  I tried to contact the authors, but never heard back.

Shame, really.  Palo should fix this, as many other internet filter vendors have support.

Dan

[OtakarKlier]

Hello,

I'm guessing that a captive portal for the end user to enter informtaion is out of the question? That said I would also like to be able to somehow detect users that did not log into a domain or picked up by the user-id agent. I know that having global protect installed helps with user-id population. However its not available for ChromeOS, if i recall.

Regards,

[BPry]

@OtakarKlier there actually is a GlobalProtect extension for Chrome so that would be one way to go; that being said with the users being students it probably isn't something that you would want to introduce into the enviroment during the school year, and depending on the age of the students would probably cause a lot of headache. 

[OtakarKlier]

@BPry, I'll have to check out the extension, thanks for that! As for the rest, I agree that there are a lot of factors that could prevent some solutions of being put into place.

[dannon]

Our students range from K - 12 and can end up using a chromebook at some point.  We don't have a 1:1 initiative, but they get a lot of use.  We have like 3K of Chromebooks here in our District.

Yes, having Global Protect wouldn't work.  Our teachers have a hard enough time getting students to log in properly with their Google@edu email and password.

I've talked with my Palo SE and he said Palo doesn't have anything on the horizon (again).  Maybe it's because Palo is a firewall first, and internet content filter second.

Pitty though.  Other products are adding Google hooks via their API to allow such things.

-Dan