Global Protect SSO with Pre-login using Certificate Issue

[Jatin.Singh]

We are rolling out GP with SSO with Pre-login using certificates as of last week. The GP agents are connecting at pre-auth and subsequently doing SSO once the user signs in with cached credentials. 

After the weekend, we are having multiple users reporting they cannot login. 

We are seeing lots of events 'globalprotectportal-auth-fail' with description 'GlobalProtect portal user authentication failed. Login from: 124.189.178.11, Source region: AU,  User name: andrew.gee, Client OS version: Microsoft Windows 10 Enterprise , 64-bit, Reason: Cookie expired, Auth type: cookie.'

We have cookie authentication override enabled on both gateway and the portal using the same CA Root, what can be the reason for this error and users not able to login

?

[kiwi]

Hi @Jatin.Singh ,

What PAN-OS and GP versions are you using ?

I've seen this on GP version 5.0.3 and it was fixed after a client upgrade.

Go to the GP's setting panel and do a "sign-out" to clear all cache.

Are you seeing any more information in the GP client logs on the reason ?

Based on the error it might be the cookie being rejected due to timeout expiration.  Is the authentication attempt reaching the gateway ?

I'd recommend checking the GP version and collecting/reviewing the client logs.

-Kiwi.

[Jonathan_C]

I am seeing the same issue with GP 5.0.8-4. Did you get to the bottom of this?

[Jatin.Singh]

This was raised with the TAC and the following fixed the issue

Action Taken:
------------------
- SSO works fine when we select GP icon as credential provider during the login.
- We also made changes to make GP as default credential provider as below.
HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SetGPCPDefault to 1