SAML Authentication - Users not prompted for password or MFA

[SethEfrat]

Hi all,

We've setup SAML / SSO and all works OK , however, when GlobalProtect starts, it automatically connects without asking for any creds. I'm assuming this is a result of the machine being joined to the same domain so the password is not needed. However, I'd like to configure it so that at least an MFA prompt occurs. 

Connecting on a non joined machine does exhibit this behavior. 

[TomYoung]

Hi @SethEfrat ,

When SAML/SSO does not prompt for creds or MFA, it is almost always an authentication cookie.  Check you IdP authentication cookie settings.

Thanks,

Tom

[jfernandez1]

This might be a known issue that is being addressed on PANOS 10.2.5 where addressed a situation where the firewall failed to appropriately initiate Single Log-out (SLO) towards the client, leading to the client's inability to trigger the SLO request towards the identity provider (IdP). Consequently, this led to the IdP not executing the SLO callback to the firewall for user removal.

Issue ID: PAN-213296

Can be found on PANOS 10.2.5 release notes:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-5-known-and-addressed...