Global Protect SSO with Pre-login using Certificate Issue

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L3 Networker

Global Protect SSO with Pre-login using Certificate Issue

We are rolling out GP with SSO with Pre-login using certificates as of last week. The GP agents are connecting at pre-auth and subsequently doing SSO once the user signs in with cached credentials. 
 
After the weekend, we are having multiple users reporting they cannot login. 
 
We are seeing lots of events 'globalprotectportal-auth-fail' with description 'GlobalProtect portal user authentication failed. Login from: 124.189.178.11, Source region: AU,  User name: andrew.gee, Client OS version: Microsoft Windows 10 Enterprise , 64-bit, Reason: Cookie expired, Auth type: cookie.'

We have cookie authentication override enabled on both gateway and the portal using the same CA Root, what can be the reason for this error and users not able to login
?
Highlighted
Community Team Member

Hi @Jatin.Singh ,

 

What PAN-OS and GP versions are you using ?

I've seen this on GP version 5.0.3 and it was fixed after a client upgrade.

Go to the GP's setting panel and do a "sign-out" to clear all cache.

 

Are you seeing any more information in the GP client logs on the reason ?

Based on the error it might be the cookie being rejected due to timeout expiration.  Is the authentication attempt reaching the gateway ?

 

I'd recommend checking the GP version and collecting/reviewing the client logs.

 

-Kiwi.

 
Highlighted
L1 Bithead

I am seeing the same issue with GP 5.0.8-4. Did you get to the bottom of this?

Highlighted
L3 Networker

This was raised with the TAC and the following fixed the issue

 

Action Taken:
------------------
- SSO works fine when we select GP icon as credential provider during the login.
- We also made changes to make GP as default credential provider as below.
HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SetGPCPDefault to 1

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!