Need assistance configuring GlobalProtect with SAML

[M.Phelps]

Hello,

I am trying to set up GlobalProtect to include SAML identity for our remote users to have MFA to go along with their username and password. Is there a step-by-step document that can walk me through this setup?

[JayGolf]

Hi @M.Phelps ,

Which identity provider are you going with? 

The overall configuration on the Palo Alto side is fairly straightforward. I don't know the exact steps on the identity provider side, but you will typically need to create a SAML application with your IdP and export the IdP metadata XML. 

One important item during the IdP configuration is the ACS URL (Assertion Consumer Service URL). This is the URL where the IdP sends the SAML assertion after successful authentication. The value must match what is configured on your portal. For example, lets say your portal URL is https://gp.company.com. You would use https://gp.company.com/SAML20/SP/ACS for the SAML ACS. 

On the firewall side, the general workflow is:

1. Import the IdP metadata XML and create the SAML Identity Provider profile.
2. Create an Authentication Profile that references the SAML IdP.
3. Apply the SAML authentication profile to the GlobalProtect Portal and/or Gateway.
4. Test connectivity. You can leverage the system logs to see GP Users logging in via your SAML auth profile.