Global Protect - SAML Authentication Complete Page

[JakeHarris]

We're testing upgrading to version 2.5.x and have run into a few changes with the new features.

We enabled "Use Default Browser for SAML Authentication", because you know ie, is going away.  After doing this, each time our end user authenticates, they receive an "Authentication Complete" Page, with a cryptic message about opening Global Protect and a link that doesn't work.  It comes from https://<VPNGatewayFQDN>/SAML20/SP/ACS

I've searched through documentation and can't seem to find anything about it, nor is it present as a response page you can customize.

Ideally we'd prefer the old behavior, close the browser window / tab that was used for the SAML authentication, but minimally, we need to reword this page so it doesn't confuse users.. Maybe use it as a banner.

This is not the "Global Protect App Welcome Page", that feature is disabled.

Any help would really be appreciated.

[SCantwell_IM]

Sounds like a feature request to me.

You would best contact your PANW SE for them to create a FR ticket. 

Good luck!

[Remo]

@JakeHarris and after you get a FR ID from your SE, post it here, so others can also vote for it.

[mike_yand]

FR ID: 18254

Let the voting begins!

[SRamsey]

Same issue. I would like to customize this page.

[fnolting]

I'd like to vote for this feature request but I couldn't find where to do that.

[NielsenStassyns]

Me too... have you found were to vote or do we need to do this via a Palo Alto SE?

[TechnicianTech]

Same thing here!

[Brandon_Wertz]

---

@JakeHarris wrote:

We're testing upgrading to version 2.5.x and have run into a few changes with the new features.

We enabled "Use Default Browser for SAML Authentication", because you know ie, is going away.  After doing this, each time our end user authenticates, they receive an "Authentication Complete" Page, with a cryptic message about opening Global Protect and a link that doesn't work.  It comes from https://<VPNGatewayFQDN>/SAML20/SP/ACS

I've searched through documentation and can't seem to find anything about it, nor is it present as a response page you can customize.

Ideally we'd prefer the old behavior, close the browser window / tab that was used for the SAML authentication, but minimally, we need to reword this page so it doesn't confuse users.. Maybe use it as a banner.

This is not the "Global Protect App Welcome Page", that feature is disabled.

Any help would really be appreciated.

---

(I know this is an old thread)

This isn't going to answer your issue, but you're using "default browser because IE was going away.  My company recently ran into this issue.  

We use "embedded browser" for SAML auth to Azure AD (Through CIE) for GP.  This wasn't working because the Global Protect software called "Webview" which essentially calls the legacy IE integration for browser authentication.  Webview/IE doesn't support TLS1.3 so we would intermittently get authention failures to GP because of this incompatibility.

Coming in GP client version 6.0.10, I'm not sure about other client version, the GP software will call "Webview2" which calls the "Edge" version to the OS browser.  This call to "Webview2" will support TLS1.3 and will allow the use of the "embedded browser" within the GP client.

[tsfdye]

Under default browser, how can we configure to automatically close the Authentication Complete Page? This is very annoying for end users who have to do this on a daily basis.