Configure a SAML 2.0-Compliant IdP in the Cloud Identity Engine

Obtain the information from your SAML 2.0-compliant IdP that you need to configure in the Cloud Identity Engine.

Copy the following information from your IdP:
Identity Provider ID
Identity Provider Certificate
Identity Provider SSO URL

In the Cloud Identity Engine app, select

Authentication

SP Metadata

Download SP Metadata

and

Save

the metadata in a secure location.

Configure the IdP in the Cloud Identity Engine.

Select
Authentication Types
and click
Add New Authentication Type
.
Set Up
a
SAML 2.0
authentication type.
Enter a
Profile Name
.
Select
Others
as your
Identity Provider Vendor
.

Select the method you want to use to

Add Metadata

.

If you want to enter the information manually, obtain the necessary information from your IdP then enter the information in the Cloud Identity Engine.
Copy or download the following information from your IdP and enter it in the Cloud Identity Engine app:
Identity Provider ID
Identity Provider Certificate
Identity Provider SSO URL
Select the
HTTP Binding for SSO Request to IdP
method you want to use for the SAML binding that allows the firewall and IdP to exchange request and response messages:
HTTP Redirect
—Transmit SAML messages through URL parameters.
HTTP Post
—Transmit SAML messages using base64-encoded HTML.
If you want to upload a metadata file, download the metadata file from your IdP management system.
Download the metadata from your IdP.
In the Cloud Identity Engine app, click
Browse files
to select the metadata file then
Open
the metadata file.
If you want to use a URL to retrieve the metadata, copy the URL from your IdP. Enter it as the
Identity Provider Metadata URL
in the Cloud Identity Engine and click
Get URL
to obtain the metadata.
If you don't want to enter the configuration information now, you can
Do it later
. This option allows you to submit the profile without including configuration information. However, you must edit the profile to include the configuration information to use the authentication type in an authentication profile.

Specify the

Maximum Clock Skew (seconds)

, which is the allowed difference in seconds between the system times of the IdP and the firewall at the moment when the firewall validates IdP messages (default is 60; range is 1–900). If the difference exceeds this value, authentication fails.

To require users to log in using their credentials to reconnect to GlobalProtect, enable

Force Authentication

.

Test SAML setup

to verify the profile configuration.

This step is necessary to confirm that your firewall and IdP can communicate.

Select the SAML attributes you want the firewall to use for authentication and

Submit

the IdP profile.

In the IdP, edit as necessary the attributes you want to use to authenticate users.
In the Cloud Identity Engine app, select the
Username Attribute
and optionally, the
Usergroup Attribute
,
Access Domain
,
User Domain
, and
Admin Role
.