Set Up LDAP Authentication for Prisma Access Agent (Strata Cloud Manager Managed Deployments)

1. Create an LDAP server profile that defines the connection to your directory server. (Skip this step if you have an existing LDAP server profile.)

   When you use LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every Active Directory (AD) domain.

   1. From Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess Agent.
   2. Select Identity ServicesAuthentication.
   3. Select Server ProfilesLDAP.

   4. Click Add LDAP Server Profiles.
   5. Specify the following options:

      • Name—Enter a name for the profile, such as ldap-server-profile.
      • Type—Select active-directory.
      • Base DN—Enter the base DN (Distinguished Name) for the LDAP directory.
      • Bind DN—Enter the bind DN to enable the authentication service to authenticate the gateway.
      • Bind Password and Confirm Bind Password—Enter the authentication credentials.
      • LDAP Server—Enter the name and IP address for the LDAP server. You can configure up to four LDAP servers in a single profile.
      • Require SSL/TLS Secure Connection—Enable this option if you want the endpoint to use SSL or TLS for a more secure connection with the directory server (enabled by default).
      • Verify Server Certificate—Enable this option if you want the endpoint to verify the certificate that the directory server presents for SSL/TLS connections. To enable verification, you must also enable the option to Require SSL/TLS Secure Connection.

      For example:

   6. Save your LDAP server profile.
2. Create an authentication profile using the LDAP server profile. (Skip this step if you already have an authentication profile for LDAP.)

   The authentication profile specifies the server profile that the Portal or gateways use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles to one or more client authentication profiles.

   1. From Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess Agent.
   2. Select Identity ServicesAuthentication.
   3. Select Authentication Profiles and Add Profile.

   4. Select Authentication MethodLDAP.
   5. Select the LDAP Server Profile that you created.
   6. Enter a Profile Name. For example:

   7. Save your authentication profile and push the configuration.
3. Configure user authentication for the GlobalProtect Portal.

   1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupGlobalProtect App.
   2. Click Add Authentication.
   3. Select Authentication MethodLDAP.
   4. To enable users to authenticate to the Portal or gateway using their user credentials, select the authentication Profile that you created in the previous step.
   5. For Certificate Authentication:

      • If you want to require users to authenticate to the Portal using both user credentials AND a client certificate, select LDAP AND Client Certificate.
      • If you want to enable users to authenticate to the Portal or gateway using either user credentials OR a client certificate, select LDAP OR Client Certificate.

      To use certificate authentication, you need to first create a certificate profile in ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentObjectsCertificate Management.
   6. Save your user authentication settings and push the configuration.

4. Configure Prisma Access Agent to use the GlobalProtect Portal for authentication.

   1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
   2. Click Add User Authentication.
   3. Select Authentication TypePortal Authentication.

      After you select Portal Authentication, the other authentication fields will no longer appear since authentication will be handled by the GlobalProtect Portal.

      Ensure that the certificate used to encrypt and decrypt the authentication override cookie is the same across the Prisma Access Agent global app settings, GlobalProtect Portal, and GlobalProtect gateway.
   4. Save your user authentication settings.
5. Enable the Save user credentials option in the Prisma Access Agent settings to provide seamless authentication across device states like sleep-wake cycles, network changes, and system restarts without repeatedly prompting the user for credentials.

   1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
   2. Click Add Agent Settings or select an existing agent setting that you want to modify.
   3. Configure the agent settings as needed and enable Save user credentials.

   4. Save your user authentication settings.
   5. Push the Prisma Access Agent Configuration.
6. Configure the GlobalProtect app settings to generate the cookie for authentication override.

   1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupGlobalProtect App.
   2. Click Add App Settings or edit an existing app setting.
   3. In the Authentication Override section, enable Generate cookie for authentication override.

      Don’t select any options in the Match Criteria section, such as selecting a Certificate Profile, as Prisma Access Agent does not currently support GlobalProtect Portal requests that involve configuration criteria.
   4. Save your settings.
7. Configure the authentication override cookie lifetime in the global agent settings.

   1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
   2. Edit the Global Agent Settings.
   3. In Certificate to Encrypt/Decrypt Cookie, ensure that the certificate is the same across the GlobalProtect Portal and GlobalProtect gateway.
   4. Configure the Cookie Lifetime to specifies the duration for which the cookie is valid.
   5. Save your settings.
   6. Push the Prisma Access Agent Configuration.
8. Verify the configuration.

   1. Test authentication from a client device running Prisma Access Agent.

      With this configuration, Prisma Access Agent will use the GlobalProtect Portal for LDAP authentication instead of the Cloud Identity Engine (CIE). When a user attempts to connect, the agent will prompt for credentials if needed, authenticate with the LDAP server via the GlobalProtect Portal, and upon successful authentication, receive a session token to secure internet and private application traffic.

      When the user clicks Connect on the Prisma Access Agent app, the agent will prompt them to enter their credentials:

      If the user already entered their LDAP credentials on macOS or the Windows login screen, the agent won’t prompt them to enter their credentials again in the Prisma Access Agent app (provided that the credentials are already saved).
   2. Run the pacli epm status command. The Authentication Type should be LDAP.
   3. Check the logs in the Log Viewer for successful authentication events.