Palo Alto with Azure SAML issue

[Kevin-Ng]

Hi all, I have configured all the required basic SAML configurations in Azure, and assigned a few test AD users to GlobalProtect enterprise application. Also configured those required settings on the Palo Alto end where I import the XML cert, create an authentication profile, and assign the profile to both my gateway and portal. You can refer to my screenshots of those configurations.

what issue i faced, once i redirect to the Microsoft portal login, and after login in, i got the below error message,

Anyone can help me find the root cause of this?

Below are my configuration:

GlobalProtect  Azure 

[Anderson_D]

Hi Kevin,

Have you checked the authd.log? I would say this could be related to problems with the SAML request/response.

less mp-log authd.log

[Kevin-Ng]

Hi, this is the error i getting . not sure what is it about? do you know?

[Anderson_D · Accepted solution]

It seems your time is not synchronized between the firewall and the IdP (Azure), thus the firewall will reject the SAML response.

This is also explained here:

Authentication error due to timestamp in SAML message from IdP - Knowledge Base - Palo Alto Networks

[Kevin-Ng]

My Palo alto have already configured with sg.pool.ntp.org. But do you happen to know where i can configure NTP/timezone for my Azure IdP?

[Anderson_D]

I don't know, I've been configuring Azure SAML for multiple regions in different timezones without issues.

Is the firewall configured in the correct timezone besides the NTP server (Device > Setup > Management > Time Zone)? I'm asking this because all SAML messages are in UTC format, maybe your problem is the firewall not being in the correct time zone and the converted time to UTC is not matching Azure's.

[Kevin-Ng]

thanks @Anderson_D ! i managed to resolve this error.

Now I have a new error where I now able to login from the browser. But when I tried to log in from the GlobalProtect App itself. i got the error from the attached image "121". Do you know what is the setting i miss out?

[Anderson_D]

Make sure your Global Protect URL matches the URL identifier configured in Azure, otherwise the request will be denied.

[Kevin-Ng]

I am using FQDN for my GP url and for my identifier in azure . Not sure why the error is showing the IP Address instead.

[Anderson_D · Accepted solution]

But even under GlobalProtect > Portals > Agent > External Gateways?