FIDO2 support for GlobalProtect client

Showing results for 
Show  only  | Search instead for 
Did you mean: 

FIDO2 support for GlobalProtect client

L2 Linker

FIDO2 Security cards during Entra ID SAML authentication does not work. The option to select a hardware "security key" during the Entra ID login flow is not shown. Only the built-in/embeded GlobalProtect web browser exhibits this issue.


The feature listing for GlobalProtect 6.2.3 says, "Starting with GlobalProtect 6.2.3, the embedded browser framework for SAML authentication has been upgraded to Microsoft Edge WebView2 (Windows) and WebKit (macOS). This provides a consistent experience between the embedded browser and the GlobalProtect client. WebView2 and WebKit are also compatible with FIDO2-based authentication methods. "


We tried the workaround to use the default OS browser for authentication, but the integration is not very smooth so it won’t be a good solution for us. Even with GlobalProtect 6.2.3 FIDO2 is not shown as an option during login.  we see the MSWebVIew2 process running during GlobalProtect SAML login.


Based on

article date 2nd Apr 2024, the current PANOS versions do not support the FIDO2 authentication through GlobalProtect. Could someone please confirm this or give us some advise here. Thanks.


GlobalProtect #FIDO2


L1 Bithead

Same here. GP 6.2.3 + embedded browser still no FIDO2 option. Default browser works as expected.

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!