Using SAML with Global Protect Client and MS Azure

[MP18]

We have configured global protect client 4.1.6.

We want to use MS Azure for MFA can we do this by using SAML?

[Remo]

In general yes it should be possible, but you did not share a lot of information to answer the question ... 

Do you already have ADFS servers? Do you use Azure MFA there already? Do you use Azure MFA already for another service in your company or do you plan to implement it completely new? 

[MP18]

No it brand new setup.

We have GP client running version 4.1.6

No we do not use Azure MFA.

What are ADFS?

How they are linked to SAML?

[Remo]

Hi @MP18

Does your company in this case already uses an Azure AD and/or Office 365 or other Microsoft Cloud Services? Or what is the exact reason to use Azure MFA if there are no prerequisites?

ADFS technically is a SAML Identity Provider (I assumed you use this one as it is probably the only SAML IdP with an Azure MFA Integration). Another way you can go is with a Microsoft NPS RADIUS Server with the Azure MFA Plugin. 

[MP18]

Yes we have office 365 in cloud and also AD but not ADFS

[Remo]

Is it possible for you that you connect other cloudservices (salesforce, dropbox business, ...) with SAML (with the existing things that you already have with your microsoft subscriptions)? If yes, then I you should be able to configure GP the same way as other SAML cloud services ... if not, you probably need ADFS ...

[Remo]

... or A Microsoft RADIUS server as an ADFS server is the more complex way I think ...

[MP18]

Yes earlier today i exported the SAML   xml file in PA.

Then i try to connect to the Client   everytime i see the error message  in system logs of PA

'SAML SSO authentication failed for user \'\'. Reason: SAML web single-sign-on failed. reply message \'Reason: SAML web single-sign-on failed.\'' )

[MP18]

Yes earlier today i exported the SAML   xml file in PA.

Then i try to connect to the Client   everytime i see the error message  in system logs of PA

SAML SSO authentication failed for user  Reason: SAML web single-sign-on failed. reply message \'Reason: SAML web single-sign-on failed.

[Remo]

Did you follow the help documents from paloalto and microsoft (https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-single-sign-on-non-gal...) to configure this?

This error message sounds very generic. When did it show up?

[MP18]

I did not do the Azure part.

Which documents of PA you refer to?

We get this error message after

saml-client-redirect

saml-signature validated

saml out of band massage 

[MP18]

[Remo]

---

@MP18 wrote:

I did not do the Azure part.

---

Without the configuration on azure side you will always get errors when you try to log in.

---

@MP18 wrote:

Which documents of PA you refer to?

---

• https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/authentica...
• https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/globalprotect-features/sam...

[MP18]

when i check the cert i get this error

•  SAML -> method -> saml-idp is invalid. Validate Identity Provider Certificate is checked but no Certificate Profile is provided
• authentication-profile -> SAML -> method is invalid
• Commit failed

[Remo · Accepted solution]

... then uncheck the checkbox or create a cert profile with the root cert of the server certificate that microsoft uses 😉