Who Me Too'd this solution

PALO ALTO NETWORKS SECURITY VULNERABILITY: GlobalProtect 2FA password + certificate does not verify that certificate matches user

Reboot-between-experiments ... load up a virgin System ...

Certificate Profile > Username Field: Subject

Gateways > Authentication > Client Authentication *none*

User key like this:

Subject: C=US, ST=CA, L=Menlo Park, O=Quantifind, OU=Ops, CN=djh/name=Daniel Howard/emailAddress=djh@example.com

Mac GlobalProtect will load the key in PKCS12 format.
User shows up as djh.

*****

Certificate Profile > Username Field: Subject

Gateways > Authentication > Client Authentication *LDAP*

Mac GlobalProtect will only let me log in as the user in the CN on the certificate.

This achieves 2FA:

• User needs to have their SSL cert.
• User needs to know their password.

On the unsupported Linux openconnect client, I can log in with any signed cert. There is no server-side enforcement that the user matches the certificate. This is a surprising vulnerability in a security product: that we rely on a client to enforce the server's authentication credentials.