GlobalProtect SAML Authentication Complete

[jonathanb]

We recently upgraded firewalls from 10.1 to 11.1.  We've stayed on globalprotect 6.2.5 and 6.2.8 the entire time.

Before the upgrade, GP would logon automatically after user logon.  GP would use SAML authentication and complete without fanfare.

After updating to 11.1, GP starts up, SAML auth to the portal opens a browser which completes SAML, and then says Authentication Complete.  GP then completes a connection to a gateway.

How do i get rid of this annoying browser page?  This wasn't happening before.

[Brandon_Wertz · Accepted solution]

---

@Sally47Mac wrote:

Hello!

The "Authentication Complete" browser page after your firewall upgrade to PAN-OS 11.1 with consistent GlobalProtect versions likely stems from a change in default SAML authentication behavior. Check the "Use Default Browser for SAML Authentication" setting in your GlobalProtect Portal configuration and try toggling it. Also, review your client configuration and consult the PAN-OS 11.1 release notes and Palo Alto Networks Knowledge Base for any relevant changes. Investigating authentication override cookie configurations might also help. As a test, consider upgrading to the latest compatible GlobalProtect client version. 

---

@jonathanb I would agree with @Sally47Mac's recommendation.  Based on what you described it's exactly what's been shared.  For SAML auth you can either use the GP client itself (embedded browser), which is what you previously had configured, or the OS "Default Browser" which would be the Internet browser the user has set as their native browser.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/changes-to-default-behavior/chang...