GlobalProtect Cert+SAML

[JordanAltmann]

Hello,

I'm reaching out to see if anyone has configured GlobalProtect with cert+SAML authentication with multiple gateways across multiple firewalls.  I've been attempting to configure this, however, whenever I use cert+SAML at the gateway and I attempt to switch gateways after logging in, the logs always show "client cert not present". 

I have both the root/intermediate configured under certificate and have an accompanying certificate profile with nothing special specifying those two certs.  I have both machine and user certs issued to the machine/user respectively.  App configuration is basic, setup with pre-logon (always-on) and is targeted for "any".  

For context, I'm able to perform cert-only authentication and if i set the subject-alt name to email in the profile, it authenticates both machine and user respectively for whichever stage its at and determines the correct user.  Likewise, with SAML only, everything works fine as well when switching gateways.  It's only when I combine cert with SAML that it fails.

I haven't been able to find many resources with concrete information on whether this is supported or not, most videos I've seen only specify SAML at the gateway.