SAML for direct login on many firewalls

[AaronAxvig]

I got SAML working fine with Okta for Panorama.  Very nice.  Next, I have "many" firewalls which are managed by Panorama, and I find myself directly logging in to them frequently enough that it would be nice to have SAML for that too.  (Context switching from Panorama to firewall would good enough to make me not care about direct login SAML but it is very glitchy...no good.)

Part of the SAML setup process is to provide a [your-base-URL] value in Okta.  So I had the Panorama value in that Okta app, and hoped to use the same Okta app for a test firewall.  No good: after the successful SAML auth, it redirects to that Panorama URL.

I set up a second Okta app with the test firewall's URL and it worked fine to login via SAML.

Since this base URL is part of the Okta app definition, that means I need to create a separate Okta app for each firewall?  Does anyone actually take the time to do this?  That would be every firewall, including each one of an HA pair.  Lots of Okta app setup, and not really any way to set it up quickly on PA side via templates either.

[JayGolf]

Hi @AaronAxvig ,

Have you looked into creating a custom Okta app? It looks like setting up a custom app with the "Allow this app to request other SSO URLs and provide the Requestable SSO" option enabled might help.