Agent Client Settings user name match when SAML

[Anbjorn]

I have a SAML setup where I want to match a specific user name to an agent config in the gateway:

Gateway -> Agent -> Client settings ->

Source User : <username>

OS: Any

Region/IP address: empty

In the SAML authentication profile the username is listed in the Allow List and is authenticated correctly. However, the client errors with "Client config not found". If I set Source User in Agent Client settings to Any, it works and user name show up in both traffic and GP logs.

Documentation says "You must configure group mapping (Device > User Identification > Group Mapping Settings) before you can select users and groups.", but this is only for AD group mapping. How can I match the username in the SAML login in the Agent client setting?

[aleksandar.astardzhiev]

Hi @Anbjorn ,

How do you configure the username for the client settings? Are you using "user@domain.com" or "domain\user" format?

If you set source username as any and clients connect and get settings successfully, what format you see for the username in the GlobalProtect logs?

[Anbjorn]

Usernames are "user@domain.com" on both logs and configuration.

[tamerfahmy]

Hi @Anbjorn - did you ever figure this out?  I am having a similar issue.  I am using SAML and I have an "any" user config which works fine.  But I am trying to add a more restrictive config above that one, which contains specific users or groups, and cannot get it to work. All users keep matching the "any" rule.