Globalprotect client authenticate with a certificate not working anymore

[ZEBIT]

Since we use our Palo Alto firewall, our users there Global Protect Client authenticate with the firewall through a certificate that is deployed thorugh Active Directory. Our Global Protect Client version is 3.0.2.

Since we updated our Pan-Os version to 7.0.6 this method of authentication does not work anymore.

THe client tries to authenticate and than there is a message: Enter username and password to login.

When to user fills in his credentials everything works, but this is not how we want it. The authentication need to go through the certificate.

I checked the Portal Gateway and it seems it has been modified with the update to 7.0.6. There is now a field SSL/TLS.

How can I fix this issue?

[Raido_Rattameister]

But you have LDAP profile also chosen so it is expected that user/password is asked.

[ZEBIT]

Our vendor did this and said it was a bckup in case the certificate does not work.

So how I can make everything work again?

[Raido_Rattameister]

If both are chosen both are asked.

If cert fails then just login fails.

Maybe someone will correct me 🙂

[emr_1]

Raido, you are correct.

His configuration is two-factor auth. (cert and ldap)

[ZEBIT]

It is no problem that the LDAP is the backup solution but if the client has the certificate no ldap is required.

[Raido_Rattameister]

ZEBIT your current setup does not set LDAP as backup.

There is AND between those profiles.

You require certificate AND credentials.

[ZEBIT]

Ok, than our vendor did a mis configuration. Strange that it worked before we updated to PAN OS 7.0.6.

How can I make it work when the client has the certificate it can authenticate?

[Raido_Rattameister]

Your internal users who have cert use one portal address with portal/gateway config that authenticates with certificate and third parties use different portal id that points to different gateway. Portal/gateway set up for third parties who don't have client cert authenticate only using LDAP.

[ZEBIT · Accepted solution]

Yesterday we found the solution. Due the update the settings for cert authentication are a bit different.

In the certificate profile you need to choose on what detail in the cert it has to check: CN, Principel name, Email.

We check for the principel name, because the principel name has to be in a specific group before it can login through the certificate.

Now everything works.