I completely agree with you that its a bug. I have already spent 15 days with Palo Alto tech support to resolve Pre-Logon then On-demand but unfortunately tech support is still unable to resolve the issue. Even in my case I am losing confidence on Palo Alot tech support. Configuration in the "App configuration" tab is telling one thing but practically it is doing another thing.
If I choose on-demand but GP Login prompt is coming up then what is the purpose of keeping On-Demand option in "App configuration" tab. This is completely unacceptable.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!