Problem with GlobalProtect password.

[Bittereinder]

Hello all!


If we put a sterling pound (£) symbol in a user password, the authentication fails. We are using GlobalProtect 4.1.8 and use a RADIUS server running Microsoft Azure MFA server on the authentication profile of the GP gateway, with just an LDAP profile on the portal. Is this related to a GlobalProtect bug?


Thanks in advance!

[hshawn]

Likely they are not escaping that character, version 5.0 had this same issue with several special characters and after reporting it the next release fixed the issue. I would recommend opening a case and supplying all the details 

protip: when this happens look at the logs and see if the XML in the logs breaks and contains the pieces of the password that occur after the special character. Add this detail (if found) to the ticket. You may also want to send your SE an email so they are aware as well. 

The characters we found here were all pretty standard special characters we did not try the pound symbol since we are in the U.S. it is not really used on our keyboards.

[Mick_Ball]

To confirm,,,

I entered AAAAAA as my password and radius got this...

14:32:27:178 [9]auth.auth.User Entered Passcode=££££££

[Bittereinder]

Thanks a lot for the reply, hshawn.
Which logs do you mean?
Thanks!

[Bittereinder]

Thank you, MickBall, for your answer.
That line you posted is from the Radius log?

Could it be that GlobalProtect is not supposed to use the sterling pound symbol because it's an American product?
Thanks!

[Mick_Ball]

sorry, long day...

I entered AAAAAA and got ...

14:32:27:178 [9]auth.auth.User Entered Passcode=££££££

so it is adding special charachter before pound sign.

sorry i cant help any further....

[Mick_Ball]

oooohhh steady, this could be the start of WW3.

you are on the right lines...   here is the Azure allowed special characters statement,,,

"Non-alphanumeric characters (special characters): (~!@#$%^&*_-+=`|\(){}[]:;"'<>,.?/) Currency symbols such as the Euro or British Pound are not counted as special characters for this policy setting."

[Mick_Ball]

i can only assume Palo have used a similar policy...