>Founf this in the release note: GPC-6663
The GlobalProtect app for iOS does not support SAML authentication when you configure GlobalProtect with the User-logon (Always On) Connect Method (NetworkGlobalProtectPortals<portal-config>Agent<agent-config>App). This limitation is due to the Apple Network Extension framework, which blocks network connections from the GlobalProtect app (where users are authenticated to their organization’s SAML identity provider) until the VPN tunnel is created. #https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-release-notes/gp-app-release-i...
>In the newer versions 5.1,5.2,5.3 and 6.0 I didn't see information that this issue got fixed, (since it's due to the Apple Network Extension framework, probably it can not be fixed on our side alone?).
>Work around found here in this article, please follow the resolution to configure On-demand as Connect Method for IOS devices. #https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMfYCAW
>Is there any solution to this?
We're experiencing the same issue. Appreciate the insight. After applying your linked work around I'm unable to get the iOS agent config selection criteria to apply despite being having the iOS os specific profile above the any OS profile. Used no login banner in the iOS profile to distinguish between the 2 profiles. I still see the login banner and get the app notification "Always on mode is enabled. Please login to continue". Regardless submitted PA-TAC ticket and will post how we resolve.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!