GlobalProtect SAML Metadata

[Sahir_Algharibih]

Hi Experts,

I have configured Azure SAML SSO for GlobalProtect. When I try to export Metadata from PaloAlto FW for global-protect service, there is a mandatory section to select which virtual system. But in my case, there is no virtual system to select from. I am not sure what's the issue. Any idea what's going on?

Thanks for your help in advance!

[michelealbrigo]

I'm on a much newer PanOS version, yet I have a very similar problem.

Platform: PA-5400 with PanOS 10.2.5

I've followed this guide:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/configure-saml-authenticat...
All certificates are installed and valid (no self-signed), I managed to complete every step, but I'm stuck at Step 5, item 4. I'm supposed to download the SAML metadata to bring it to my IdP, but I can't. Whether I turn on IdP validation and request signing or I turn them off, I get nothing in the box where I should select which service I want to turn SAML on for:

 Any clue on what I am missing? Is there any requirement for the request signing certificate? (e.g. it does it have to match the FQDN of the IP of the service route sending SAML requests? And which one is the service route sending them?)

[ksalustro]

I have configured GP with SAML with both Azure and Duo. I have never done step 5 and IMHO, it's not needed. On Azure, I go to Enterprise Applications, go to "Palo Alto Networks - GlobalProtect" then "set up single sign on" and put in the info:

Basic SAML Configuration Identifier (Entity ID)      https://vpn.mycompany.com:443/SAML20/SP
Reply URL (Assertion Consumer Service URL)      https://vpn.mycompany.com:443/SAML20/SP/ACS
Sign on URL      https://vpn.mycompany.com
Relay State (Optional)
Logout Url (Optional)

[michelealbrigo]

Sorry, I apparently posted in the wrong thread, after opening a dozen from Live Community: I am NOT using Azure.

My SAML IdP is internal, and our system require a two-way trust between IdP (the SAML SSO portal) and Sp (the firewall). Nonetheless, even disabling the related configuration on the firewall, I can't export the metadata for the IdP.