For details on cookie usage on our site, read our Privacy Policy
Azure SAML authentication: validate identity provider certificate. (best pratices)
- LIVEcommunity
- Discussions
- Network Security
- Next-Generation Firewall Discussions
- Azure SAML authentication: validate identity provider certificate. (best pratices)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
Azure SAML authentication: validate identity provider certificate. (best pratices)
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-25-2023 03:18 AM
Hi,
We have configured SAML on our portal and gateway. By default Microsoft generates a self signed certificate that is valid for 3 years for every Enterprise application you create.
Is this secure enough to use the default self signed one and not validate it on my gateway/portal leave the check unmarked.
According to this article it should be save if you are running the correct version of Panos.
Securing your SAML Deployments - Knowledge Base - Palo Alto Networks
CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication (paloaltonetworks.com)
We could generate a certificate from our Internal PKI and upload this in Azure.
What is the best pratice aroudn this.
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-25-2023 03:39 PM
Hi there.. I think with today's modern PANOS, this not going to be an issue. We routinely do SAML cert setups in our PS organization and the Validate Cert is always disabled.
Hope this helps.
- still stuck on client certificate required for authentication - Mac computer in GlobalProtect Discussions
- Url access error in Next-Generation Firewall Discussions
- SAML Integration with Local Authentication in Next-Generation Firewall Discussions
- EDL - unable to get local issuer certificate in Next-Generation Firewall Discussions
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
