Panorama admin UI - Okta SAML

[avivda]

Hi, we are trying to configure the Panorama SAML authentication within our Okta tenant, and we couldn't get it done due to an invalid sign-in certificate in the "Authentication profile" section.

We have followed the following Palo Alto and Okta documents below, generated an authority certificate, and published it to the Okta app via the API call according to the Okta CSR generation process:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UXP#:~:text=updated%20it%...

https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Palo-Alto-Networks-Admin-UI.html?b...

It seems like Palo Alto detects sign in certificates only if they are within a private key in the profile itself and not by request as Okta works (Every sign request generates a key)

I'm wondering how to make it work if we have a signed authority certificate that works great on Okta(the logs show it) but is not accepted by the Panorama console.

It would be great if someone who is familiar with the process could give us some insights about connecting the Panorama admin UI within Okta SAML.

Thanks!