Palo Alto 2FA integration with OKTA not showing domain in username

[Sergi-Tost]

Hello everyone,

We have successfully deployed the 2FA authentication for GP Portal and GP Gateway with OKTA SAML. In Okta we have the active directory integration for the user-mapping at the okta instance. 

The login and 2FA is working fine but when the users log's in, they are displayed at the monitor sometimes with the domain (domain\username) and sometimes only with the username so we can't apply policies with user or group restrictions.

Does anyone know which is the problem?

Regards,

Sergi

[TomYoung · Accepted solution]

Hi @Sergi-Tost ,

I was waiting for someone with more Okta experience to reply, but no one has.

With SAML, the format of the username is determined by the IdP.  You would need to find something in the Okta cloud configuration to standardize the format.  Do you think it is simply an issue where sometimes the user logs in with the domain and sometimes not?

Thanks,

Tom

[OtakarKlier]

Hello,

Also check with the vendor as they had a recent breach. Make sure your stuff is safe and protected.

Regards,

[Sergi-Tost]

Hello TomYoung,

Yes the problem was at Okta side. We performed a custom type format for the user when sending to the Firewall.