AzureAD Group Mapping for GP

[SBI_INFRASTRUCTURE]

Hello,

We're currently implementing GlobalProtect with SAML Authentification to AzureAD only (no hybrid) based on groups for easier management.

Example :

Groupe1 is given an IP_Pool1 IP with access to subnet1

Groupe2 is given an IP_Pool2 IP with access to subnet 1 and 2

As of today, we didn't find any way to do it properly and from what we've seen online it may not be supported at all without any third party or on-prem AD.

Did any of you ran into that issue before and did you find the solution?

Thanks.

[SBI_INFRASTRUCTURE]

Will do - thanks for you input.

[Tony_Ellis]

Yeah that is what i found as well.  What i ended up doing, on an ASA, is authenticating my users to Azure, but then using secondary authorization to the internal AD user to map the users to specific groups.

[Housing1]

How?

[Tony_Ellis]

Here you go:

tunnel-group NA_Azure_SAML type remote-access
tunnel-group NA_Azure_SAML general-attributes
address-pool VPN_Pool_1
authorization-server-group AAA-VPN-Users
default-group-policy NoAccess
tunnel-group NA_Azure_SAML webvpn-attributes
authentication saml
group-alias VPN-Secured enable
without-csd
saml identity-provider https://sts.windows.net/numbers......./

!

So the process is it authenticates to Azure SAML, but authorization is AAA-VPN-Users (which is AD).  it looks for a security group tied to the end user and then maps that security group to a policy group on the ASA.  This took awhile for me to figure out and get working.  But saved me a lot of work in the long run because we have so many policy group mappings to security groups.

[TomYoung]

Hi @SBI_INFRASTRUCTURE ,

I believe the Cloud Identity Engine can now get groups from AzureAD.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/identity-features/cloud-identity-e...

Thanks,

Tom