Global Protect SSO with Pre-login using Certificate Issue

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Global Protect SSO with Pre-login using Certificate Issue

L3 Networker
We are rolling out GP with SSO with Pre-login using certificates as of last week. The GP agents are connecting at pre-auth and subsequently doing SSO once the user signs in with cached credentials. 
After the weekend, we are having multiple users reporting they cannot login. 
We are seeing lots of events 'globalprotectportal-auth-fail' with description 'GlobalProtect portal user authentication failed. Login from:, Source region: AU,  User name: andrew.gee, Client OS version: Microsoft Windows 10 Enterprise , 64-bit, Reason: Cookie expired, Auth type: cookie.'

We have cookie authentication override enabled on both gateway and the portal using the same CA Root, what can be the reason for this error and users not able to login

Community Team Member

Hi @Jatin.Singh ,


What PAN-OS and GP versions are you using ?

I've seen this on GP version 5.0.3 and it was fixed after a client upgrade.

Go to the GP's setting panel and do a "sign-out" to clear all cache.


Are you seeing any more information in the GP client logs on the reason ?

Based on the error it might be the cookie being rejected due to timeout expiration.  Is the authentication attempt reaching the gateway ?


I'd recommend checking the GP version and collecting/reviewing the client logs.



LIVEcommunity team member, CISSP
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

L1 Bithead

I am seeing the same issue with GP 5.0.8-4. Did you get to the bottom of this?

This was raised with the TAC and the following fixed the issue


Action Taken:
- SSO works fine when we select GP icon as credential provider during the login.
- We also made changes to make GP as default credential provider as below.
HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SetGPCPDefault to 1

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!