Agent Client Settings user name match when SAML

[Anbjorn]

I have a SAML setup where I want to match a specific user name to an agent config in the gateway:

Gateway -> Agent -> Client settings ->

Source User : <username>

OS: Any

Region/IP address: empty

In the SAML authentication profile the username is listed in the Allow List and is authenticated correctly. However, the client errors with "Client config not found". If I set Source User in Agent Client settings to Any, it works and user name show up in both traffic and GP logs.

Documentation says "You must configure group mapping (Device > User Identification > Group Mapping Settings) before you can select users and groups.", but this is only for AD group mapping. How can I match the username in the SAML login in the Agent client setting?

[aleksandar.astardzhiev]

Hi @Anbjorn ,

How do you configure the username for the client settings? Are you using "user@domain.com" or "domain\user" format?

If you set source username as any and clients connect and get settings successfully, what format you see for the username in the GlobalProtect logs?

[Anbjorn]

Usernames are "user@domain.com" on both logs and configuration.

[tamerfahmy]

Hi @Anbjorn - did you ever figure this out?  I am having a similar issue.  I am using SAML and I have an "any" user config which works fine.  But I am trying to add a more restrictive config above that one, which contains specific users or groups, and cannot get it to work. All users keep matching the "any" rule.

[gudmundur]

Same here

We are able to supply configuration to SAML groups using cloud identity engine to pull user to group membership.

But we can not supply configuration directly to saml users

Did anyone figure this out ? 

We do not have any AD or LDAP for user group matching