06-15-2023 01:35 PM
For weeks, we have been testing combinations of attempting to go passwordless via the use of Smart Cards. The reason being is that Smart Cards work with all the technologies we have and Global Protect supports PIN SSO with Smart Cards for a seamless sign in.
There is an unfortunate side effect with the Global Protect Windows Credential Provider and Provider Filter in that if you disable the native password provider, the Global Protect wrapped Smart Card provider does not show up on lock, reboot, etc on the LogonUI screen. The wrapped SC provider seems to show up consistently only if the password provider is also enabled (not ideal since the point is to get away from passwords), it does not, however, ever select itself as the default provider (password will always be displayed first, and you will have to choose other sign-in options to reveal the GP wrapped SC provider). In addition to this issue, if you attempt to set the GP provider to be the default, you have the same issue where the provider doesn't show up on the lock screen or LogonUI screen (on bootup) without either waiting for the LogonUI to time out after 30 seconds, or reinserting the SC.
I'm curious how many others have run into this issue and to hopefully get more eyes on this issue from the PA side to get this issue resolved.
Right now, our best option is to disable the GP provider altogether so the Native SC provider is available and have a somewhat poor login experience by having the user enter their PIN (via the native Windows prompt) for the GP client to authenticate post-logon. There's more useability issues here if a user logs in, doesn't put their PIN in and the tunnel times out after our 180 countdown. This requires them to log off and log back in due to pre-logon not being able to request a Kerberos ticket after the tunnel disconnects.
Anyway, curious to see how others handle this situation as well if you've went passwordless via Smart Card and utilize always-on VPN.
