GlobalProtect SAML Login Loop

[inductivehealth]

Hi All,

I am using CIE and EntraID with SAML to allow logins to GP. This is working very well but I am having an issue. I had a user whose name changed. When logging into GP, it just continuously asks her to log in. Inside of the GP Portal, I get the error 'username from cas sso response is different from the input' and can see where it is trying to use her old email address to log in. She is using her new address and has tried with multiple browsers but no luck. 

I am guessing it is something with the Microsoft profile but I have no idea where to look. Has anyone seen this and then resolved the issue?

[arusharma]

Firewall just redirects the user to CIE and waits for the validated token for that user. I think you should look at EntraID and check CIE logs for authentication.

[inductivehealth]

Thank you for the response. CIE logs are actually showing the right username. It seems that only the firewall is showing the wrong one. 

[arusharma]

We need to take a look at the firewall logs for more clarity.