Windows Hello and GlobalProtect

[tusharbanik]

Hi Team,
We are wanting to confirm if there has been any progress on the compatibility issues between Windows Hello and GlobalProtect. We have seen when using the Windows Hello GINA with GlobalProtect the user will be prompted
for their password when trying to connect to a VPN using GlobalProtect. Is it possible to setup SSO between Windows Hello and GlobalProtect?
We are using GlobalProtect version 6.0.5.

[vkrishnap]

Hi Tushar

Global Protect SSO does not support the Windows Hello feature. Currently, you can use Windows Hello to login to the endpoint and use any of the supported transparent authentication mechanisms - certificate authentication, Kerberos, cookies, saved credentials to seamlessly establish the Global Protect connection.

Kerberos SSO is usually recommended if that is the case, though for Kerberos SSO we will first need to be able to reach KDC/AD (which is usually internal), so it is used sometimes with the pre-logon combination. If we use Kerberos SSO, Global Protect does not care how the user will log in (Windows Hello or any other way, since any logon will create Kerberos TGT with which the user will be able to get the Service Ticket for Global Protect). The only pre-requisite here is that the Global Protect/Client needs to be able to reach KDC/AD in order to get the ticket (internal network or external network with pre-logon). In short, we cannot wrap Windows Hello credential provider with the Global Protect credential provider.

Biometric Sign-In Support
https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-new-features/new-features-rele...

Below are some related discussions on the SSO and Windows hello features.
https://live.paloaltonetworks.com/t5/general-topics/global-protect-quot-single-sign-on-quot-with-win...

Regards,
Venkata Sai Krishna