PaloAlto/Okta CaptivePortal Stopped Working

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

PaloAlto/Okta CaptivePortal Stopped Working

L3 Networker

Hello!  I've had PaloAlto/Okta captive portal authentication working for awhile now.  I recently upgraded Okta to Okta Identity Engine, and also upgraded my PA to the latest 10.x.x version.  One of those upgrades appears to have broken the Okta/PA integration. SP initiated authentications STILL WORK.  IDP initiated authentications do NOT WORK - they redirect to Okta for entering credentials, and then hang on the re-direct back to the PA.  i.e, they hang on:

https://xxxxxxxx.okta.com/login/token/redirect?stateToken=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

 

The Okta logs show only successful authentications, and no errors.  Thus Okta support says the issue is outside of their control.

 

Any suggestions?

Thank you!

 

 

1 accepted solution

Accepted Solutions

L3 Networker

I opened a case with PA about this and it turns out that broken OKTA SAML authentication is a known bug PAN-OS 10.2.3 (version I'm on)!

PA engineering is working on a fix.  PAN-OS 10.2.4 / 11.0.1 is the target fix version, with an ETA is "TBD"....

 

 

View solution in original post

10 REPLIES 10

L3 Networker

I opened a case with PA about this and it turns out that broken OKTA SAML authentication is a known bug PAN-OS 10.2.3 (version I'm on)!

PA engineering is working on a fix.  PAN-OS 10.2.4 / 11.0.1 is the target fix version, with an ETA is "TBD"....

 

 

FYI the Okta doc about setting up PA CaptivePortal SSO (https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Palo-Alto-Networks-CaptivePortal.h...) currently states that Idp-Initiated is not supported.  Not sure if that has always been there or is something new just for this issue.

Quote:

SP-initiated flows are supported.

IdP-initiated flows and Just In Time (JIT) Provisioning are not supported.

Hmm, very interesting. It has worked for me for years, and is set up following the standard procedure Okta outlines for integration. I suspect this must be a tacit acknowledgment of the bug.  Update from PA support on this is that the fix is supposed to be released sometime in March....

L1 Bithead

A few months back I updated to 10.2.x, then my CP seemed to break using SAML to Ping. I went back to 10.1.x. I just saw in 10.2.3-h4, (PAN-210513) they fixed a CP SAML issue. Maybe that is your fix and maybe mine as well, will need to re-update and test later. Maybe if you test it first, reply and let us know if that addresses your issue.

L3 Networker

Yes I noticed that too.  I updated to 10.2.3-h4 today, but it unfortunately did not fix the issue for me.  The rep told me earlier that I'll have to wait until 10.2.4 for the fix.

 

L1 Bithead

unfortunate, guess i'll wait too before i try mine again, last time i did this i saw the redirect back to the PA and where it also hung and ended up needing to drive to office to restore.

L1 Bithead

I see 10.2.4 is out, if you get to test it and if fixes your issue, would like that feedback.

L1 Bithead

@RSteffens - curious if you made the jump to 10.2.4-h2 and if that fixed your captive portal issue? 

I'll be running the update in a couple weeks and will report at that time!

L1 Bithead

@RSteffens - I updated to 10.2.4-h3 and that seemed to address my CP issues we saw in 10.2.2

  • 1 accepted solution
  • 2767 Views
  • 10 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!