Change logo for Authentication Complete page

[JoseCortijo]

Hi,

We have PA-850 with globalprotect 5.2.

To make it more clear for our users we would like to customize the logo shown in the portal and whenever the user authenticates correctly. We are using Azure AD via SAML.

Currently we do have the default page (attachment).

Thanks a lot.

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[aleksandar.astardzhiev]

Hi @JoseCortijo ,

That is interesting... I haven't see such response page before, although we also use GP with SAML for one setup. When you receive this message - when user tries to open GP portal address with web browser or when user tries to connect with GP client?

In any case Device -> Response Pages is the only place where you can customize the response pages that FW is hosting. I don't see anything there looks like your screenshot. Have you try to edit "GlobalProtect Portal Login Page" and put a link for the log variable?

[techreg]

Hi @astard

yes, we use GlobalProtect with SAML. that page is the response the user receives once he successfully authenticates against azure AD. Then, the page executes a callback to the global protect client to complete the tunnel and the status "Connected" appears in the agent.

I added the logo and I imported the modified file. But now I am not sure if I should delete the previous one, they are both listed now with different locations. I could not find an explanation about that field in the official doc.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/device/device-response-pages

any idea what is the purpose of that?

[aleksandar.astardzhiev]

Hi @JoseCortijo ,

You cannot delete/remove "predefined", if you have uploaded a custom one it will be used instead of the predefined.

I want to focus on what you said:

"that page is the response the user receives once he successfully authenticates against azure AD. Then, the page executes a callback to the global protect client to complete the tunnel and the status "Connected" appears in the agent"

Just to be completely clear:

1. You click on connect button on the GlobalProtect

2. Window pops up, prompting the user to authenticate.

3. If user has entered correct credentials, he will see the page from your first screenshot

4. After that GlobalProtect will connect and the browser window will close

I believe this page is actually served by Azure

[JoseCortijo]

Hi @aleksandar.astardzhiev 

yes I can confirm all your assumptions. Your steps exactly describe the authentication workflow we have in place.

I also checked in Azure AD for response pages related to the globalprotect enterprise app but I did not find anything that could be customize.