Manage Third Party Identity Provider Integrations Through Common Services

• Add an Identity Federation to integrate with a third party identity provider (IDP) to allow access to the platform, rather than adding users directly to the platform itself. Identity Federation enables users of different enterprises or domains to use the same digital identity to access all their applications.
• After you add an identity federation, you can configure a Security Assertion Markup Language (SAML) provider in one of the following ways:
  • Manually Configure a SAML Provider
  • Upload SAML Identity Provider Metadata
  • Get the URL of a SAML Identity Provider
  • Clone a SAML Identity Provider
  SAML IDP-initiated flow is not supported for Common Services. Compared to SP-initiated SSO, IdP-Initiated SSO is less secure. It is susceptible to injected assertions, where an attacker steals a SAML assertion and injects it into the service provider.
• After you add an identity federation, you can Add Additional Identity Federation Owners who can also manage the domain and the identity federation.
• After adding identity federation owners, you can also Delete Identity Federation Owners who no longer need to manage the domain and the identity federation.
• After you add an identity federation, you can Configure Palo Alto Networks as a Service Provider by downloading the service provider (SP) metadata from Common Services. The SP metadata helps you configure your identity provider integration with Palo Alto Networks as an SP, so that you don’t have to provide the details manually.
• Delete an Identity Federation if you no longer need it.
• If you want to grant authorization to your users by passing the login information through your Security Assertion Markup Language (SAML) provider, you can Map a Tenant for Authorization. By using the tenant mapping, you no longer have to add users and access directly through Common Services, but that option is still available.
• After you map tenants for authorization, you can Update Tenant Mapping for Authorization if you need to make changes.
• When assigning an access policy to a user or a service account (such as in mapping a tenant for SAML authorization purposes), the PAN Resource Name Mapping identifies the tenant or tenant service group (TSG) hierarchy where you are applying access policies.