>
    Configure Mobile Users without Cloud Identity Engine
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Microsoft Integrations with Prisma Access
    4. Azure AD SAML Authentication for Mobile User Deployments
    5. Configure Mobile Users without Cloud Identity Engine
    Download PDF
    Prisma Access

    Configure Mobile Users without Cloud Identity Engine

    Table of Contents

    Configure Mobile Users without Cloud Identity Engine

    Where Can I Use This?
    What Do I Need?
    • Prisma Access (Cloud Management)
    • Prisma Access (Panorama Managed)
    To configure SAML authentication in Azure AD, you must register your Prisma Access deployment with Azure AD. Azure AD authentication is supported with Prisma Access GlobalProtect and Explicit Proxy deployments.
    You first configure SAML in Azure AD, then import the metadata XML file (the file that contains SAML registration information) from Azure AD and upload it to a
    SAML Identity Provider
     you create in Prisma Access. You then create an
    Authentication Profile
     that references the IdP server profile, add the authentication profile into the Explicit Proxy or GlobalProtect configuration, and commit and push your changes.

    Cloud Management

    This procedure assumes that you have a Microsoft Azure AD account, can create and modify enterprise applications, can set up a SAML Service Provider in Azure AD, and can download SAML metadata XML files in Azure.
    1. Log in to Azure AD and open the enterprise application for either GlobalProtect or Explicit Proxy, depending on the deployment type.
      GlobalProtect has its own app in Azure AD; for Explicit Proxy, Palo Alto Networks does not have an existing enterprise application for Explicit Proxy and you must create one.
      Palo Alto Networks does not control your Azure AD setup and the UI might be different than these examples. For more information, refer to the Microsoft Azure documentation.
      • GlobalProtect Deployments
        —Select
        Home
        Enterprise Applications
        ; then, search for
        Palo Alto Networks - GlobalProtect
         and select the
        Palo Alto Networks - GlobalProtect
         application. Rename the application if required.
      • Explicit Proxy Deployments
        —Select
        Home
        Enterprise Applications
         and create a
        New application
        ; then, select
        Create your own application
        , give it a
        Name
        , select
        Integrate any other application you don’t find in the gallery
        , and
        Create
         it.
        After you create the application, select it.
    2. Set up the Azure AD application.
      1. Assign Users and groups
         and
        Add user/group
         that require the Azure AD authentication.
        Alternatively, you can select
        Users and groups
         from the left navigation pane to
        Add user/group
        .
      2. Select
        Set up single sign on
         from the button or select
        Single sign on
         from the left navigation pane.
      3. In the
        Basic SAML Configuration
         area, click
        Edit
        .
      4. Enter the parameters for your Explicit Proxy or GlobalProtect deployment.
        • Mobile Users—GlobalProtect Deployments
          —Enter the following parameters:
          • In the
            Identifier (Entity ID)
             area, enter a URL of
            https://
            portal-name
            :443/SAML20/SP
            , where
            portal-name
             is the Mobile Users—GlobalProtect portal name (in Prisma Access select
            Manage
            Service Setup
            GlobalProtect
            ), and select that as the
            Default
             entity ID.
            In addition, enter all gateway names in the format of
            https://
            gateway-name
            :443/SAML20/SP
            .
            If you are configuring a standalone GlobalProtect deployment, you can use either the FQDN or IP address of the GlobalProtect portal as the
            portal-name
            .
          • In the
            Reply URL (Assertion Consumer Service URL)
            , re-enter the portal and gateway names, appending ACS to the URL names (
            https://
            portal-name
            :443/SAML20/SP/ACS
             and
            https://
            gateway-name
            :443/SAML20/SP/ACS
            , respectively). Specify the portal name as the default.
        • Explicit Proxy Deployments
          —Enter the following parameters:
          • In the
            Identifier (Entity ID)
             area, enter an Entity ID of
            https://ACS URL/saml/metadata
            , where the ACS URL is explicit proxy mobile users name (in Prisma Access, select
            Manage
            Service Setup
            Explicit Proxy
            ) and select that as the
            Default
             identifier.
          • In the
            Reply URL (Assertion Consumer Service URL)
            , enter a SAML Assertion Consumer Service URL of
            https://global.acs.prismaaccess.com/saml/acs
             and select that as the
            Default
             entity ID.
          • Use
            https://global.acs.prismaaccess.com/saml/acs
             as the
            Sign on URL
            .
      5. In the
        Set Up Single Sign-On with SAML
         pane, select
        Edit
         in the
        User Attributes & Claims
         area.
      6. Enter the following values:
        • Enter
          user.userprincipalname
           as the
          Unique User Identifier (Name ID)
          .
        • In the
          Additional Claims
           area, add a
          Claim Name
           of
          username
           and a
          Value
           of
          user.userprincipalname
          .
          You must add this claim to ensure correct username-to-IP address mapping for authenticated users.
    3. Export the metadata XML file from Azure AD and save it to a client system from which you can upload it to Prisma Access by clicking
      Download
       in the
      Federation Metadata XML
       area.
      Prisma Access requires this XML file to retrieve the correct SAML attributes from Azure AD. You upload the file when you create the SAML IdP profile in Prisma Access.
    4. (
      For GlobalProtect mobile users only
      ) In Prisma Access, configure an authentication profile for Azure AD.
      The profile defines authentication settings that are common to a set of users.
      1. Select
        Manage
        Configuration
        Identity Services
        Authentication
        Authentication Profiles
        .
        Make sure that you are creating the authentication profile for GlobalProtect or explicit proxy mobile users.
      2. Add Profile
        .
      3. Select the
        SAML
         authentication method.
      4. Enter a profile name and
        Import MetaData
         that you downloaded in step 3.
        When you import the metadata, it fills other fields.
        Save
         this authentication profile.
    5. Attach the authentication profile to the mobile users.
      The profile defines authentication settings that are common to a set of users.
      • For GlobalProtect mobile users
      1. Select
        Manage
        Service Setup
        GlobalProtect
         and
        Add Authentication
        .
      2. Enter values.
        Make sure you select the
        SAML
         authentication method and profile you created in step 4.
      3. Save
         the authentication.
      4. Move the authentication to the top to prioritize it.
      • For explicit proxy mobile users
      1. Select
        Manage
        Service Setup
        Explicit Proxy
        .
      2. Edit the
        User Authentication
         settings.
      3. Import Metadata
        .
      4. Choose file
         that you downloaded in step 3.
      5. Import
        .
      6. Enter a name and
        Save
        .
    6. Push
       your changes.
    7. Commit
       and
      Push
       your changes.
    8. Verify that SAML authentication is working.
      1. From a mobile user’s endpoint, authenticate from a supported browser.
        • GlobalProtect Deployments
          —Open the GlobalProtect app to find the GlobalProtect
          Portal
          ; then, enter the portal URL in a supported browser.
        • Explicit Proxy Deployments
          —Navigate from a supported browser to a website that is protected by Explicit Proxy.
      2. When you are challenged for authentication, verify that you are redirected to Azure AD and are presented with a login page.
        After you successfully authenticate to Azure AD, Azure AD redirects you to Prisma Access. Prisma Access then validates the SAML responses from Azure AD and the mobile user should be allowed to visit the website (for Explicit Proxy deployments) or you can successfully log in to the GlobalProtect portal (for GlobalProtect deployments).
      3. View the logs and verify that the mobile user’s username is displayed in the Traffic, URL Filtering, and Authentication logs.

    Panorama

    This procedure assumes that you have a Microsoft Azure AD account, can create and modify enterprise applications, can set up a SAML Service Provider in Azure AD, and can download SAML metadata XML files in Azure.
    1. Log in to Azure AD and open the enterprise application for either GlobalProtect or Explicit Proxy, depending on the deployment type.
      GlobalProtect has its own app in Azure AD; for Explicit Proxy, Palo Alto Networks does not have an existing enterprise application for Explicit Proxy and you must create one.
      Palo Alto Networks does not control your Azure AD setup and the UI might be different than these examples. For more information, refer to the Microsoft Azure documentation.
      • GlobalProtect Deployments
        —Select
        Home
        Enterprise Applications
        ; then, search for
        Palo Alto Networks - GlobalProtect
         and select the
        Palo Alto Networks - GlobalProtect
         application.
      • Explicit Proxy Deployments
        —Select
        Home
        Enterprise Applications
         and create a
        New application
        ; then, select
        Create your own application
        , give it a
        Name
        , select
        Integrate any other application you don’t find in the gallery
        , and
        Create
         it.
        After you create the application, select it.
    2. Set up the Azure AD application.
      1. Select
        Set up single sign on
         from the button or select
        Single sign on
         from the left navigation pane.
      2. In the
        Basic SAML Configuration
         area, click
        Edit
        .
      3. Enter the parameters for your Explicit Proxy or GlobalProtect deployment.
        • Mobile Users—GlobalProtect Deployments
          —Enter the following parameters:
          • In the
            Identifier (Entity ID)
             area, enter a URL of
            https://
            portal-name
            :443/SAML20/SP
            , where
            portal-name
             is the Mobile Users—GlobalProtect portal name (
            Panorama
            Cloud Services
            Status
            Network Details
            Mobile Users—GlobalProtect
            Portals
            ), and select that as the
            Default
             entity ID. is the Mobile Users—GlobalProtect host name, and select that as the
            Default
             identifier.
            In addition, enter all gateway names (
            Panorama
            Cloud Services
            Status
            Network Details
            Mobile Users—GlobalProtect
            Gateways
            ) in the format of
            https://
            gateway-name
            :443/SAML20/SP
            .
            If you are configuring a standalone GlobalProtect deployment, you can use either the FQDN or IP address of the GlobalProtect portal as the
            portal-name
            . To find the FQDN or IP address, select
            Network
            Portal
            portal-config
            Agent
            agent-config
            External
            .
          • In the
            Reply URL (Assertion Consumer Service URL)
            , re-enter the portal and gateway names, appending ACS to the URL names (
            https://
            portal-name
            :443/SAML20/SP/ACS
             and
            https://
            gateway-name
            :443/SAML20/SP/ACS
            , respectively). Specify the portal name as the default.
        • Explicit Proxy Deployments
          —Enter the following parameters:
          • In the
            Identifier (Entity ID)
             area, enter an Entity ID of
            https://global.acs.prismaaccess.com/saml/metadata
             and select that as the
            Default
             identifier.
          • In the
            Reply URL (Assertion Consumer Service URL)
            , enter a SAML Assertion Consumer Service URL of
            https://global.acs.prismaaccess.com/saml/acs
             and select that as the
            Default
             entity ID.
      4. In the
        Set Up Single Sign-On with SAML
         pane, select
        Edit
         in the
        User Attributes & Claims
         area.
      5. Enter the following values:
        • Enter
          user.userprincipalname
           as the
          Unique User Identifier (Name ID)
          .
        • In the
          Additional Claims
           area, add a
          Claim Name
           of
          username
           and a
          Value
           of
          user.userprincipalname
          .
          You must add this claim to ensure correct username-to-IP address mapping for authenticated users.
      6. From the left navigation pane, select
        Users and groups
         and
        Add user/group
         that require the Azure AD authentication.
    3. (
      Optional
      ) If you use a certificate authority (CA)-issued certificate or any other certificate that requires that you validate it when you import the SAML IdP profile into Prisma Access, configure your identity provider certificate in Panorama and in Azure AD.
      If your deployment certificates issued by a CA for SAML authentication, or if the SAML certificate is part of your enterprise’s public key infrastructure (PKI), you must upload the certificate to Azure AD before you export the metadata XML file from Azure AD. If you do not upload the certificate, Panorama can not validate the certificate for use with Prisma Access. For more information about the steps you perform in Azure AD, refer to the Microsoft Azure documentation
      1. From the Panorama that manages Prisma Access, select
        Device
        Certificate Management
        Certificates
        Device Certificates
         and create a self-signed root CA certificate (if you have not done so already).
      2. Generate a certificate from your enterprise root CA as a subordinate certificate.
        Be sure to select
        Certificate Authority
         so that this certificate can be validated by the authentication profile you create in a later step.
      3. Select the certificate you created and
        Export Certificate
        .
        Because you need both the certificate and a certificate password for enhanced security, select
        Encrypted Private Key and Certificate (PKC512)
         and enter a
        Passphrase
        .
      4. From Azure AD, in the SAML Signing Certificate area, select
        Edit
        .
      5. Import Certificate
        .
      6. Select the
        Certificate
         you exported from Panorama and enter the
        PFX Password
        , which is the
        Passphrase
         (password) you entered for the certificate.
      7. Select the certificate you uploaded and
        Make certificate active
        .
      8. (
        Optional
        ) If you have another certificate uploaded, either deactivate it or delete it.
        For more information about uploading and activating certificates, refer to the Microsoft Azure documentation.
    4. Export the metadata XML file from Azure AD and save it to a client system from which you can upload it to Prisma Access by clicking
      Download
       in the
      Federation Metadata XML
       area.
      Prisma Access requires this XML file to retrieve the correct SAML attributes from Azure AD. You upload the file when you create the SAML IdP profile in Panorama.
    5. Log in to the Panorama that manages Prisma Access, add a SAML IdP server profile, and import the metadata XML file you downloaded to the profile.
      You import the SAML metadata file from Azure so that Prisma Access can automatically create a server profile and populate the connection, registration, and IdP certificate information.
      1. From the Panorama that manages Prisma Access, select
        Device
        Server Profiles
        SAML Identity Provider
        .
        Make sure you are in the
        Explicit_Proxy_Template
         (for explicit proxy deployments) or
        Mobile_User_Template
         (for GlobalProtect deployments).
      2. Import
         the metadata XML file from Azure to the SAML IdP.
      3. Enter a
        Profile Name
         to identify the server profile.
      4. Browse
         to the
        Identity Provider Metadata
         file.
      5. (
        Optional
        ) If you are using a CA-issued certificate for SAML authentication, select
        Validate Identity Provider Certificate
        ; otherwise, leave this choice deselected.
        Make sure that you have added the SAML certificate to Microsoft Azure in Step #id625035b1-af11-44b4-a91a-a40a7ba67679_ide883dcb1-ad6d-433d-bd02-d197a48feb3c.
    8. Add the authentication profile you created to the Explicit Proxy or GlobalProtect deployment.
    9. Commit
       and
      Push
       your changes.
    10. (
      Explicit Proxy Deployments Only
      ) Configure the PAC file to bypass the URLs used for authentication with Explicit Proxy.
      Explicit Proxy provides you with a sample PAC file that you add to your end users’ browsers; you can modify this PAC file or edit an existing one.
      Palo Alto Networks recommends that you edit the PAC file to add the following Azure-specific URLs by bypass Explicit Proxy:
      • *.microsoftonline.com
      • *.azure.com
      • *.msauth.net
      • *.microsoftazuread-sso.com
      • *.login.windows.net
    11. (
      Optional
      ) Configure user and group mapping settings by associating the Cloud Identity Engine with Prisma Access.
      While you cannot authenticate users with Prisma Access using the Cloud Identity Engine, you can use the Cloud Identity Engine to simplify the retrieval of user and group information from Azure AD to enforce user- and group-based policy.
      1. Create a Cloud Identity Engine instance for Prisma Access, and make a note of the instance name.
        When you activate the Cloud Identity Engine, it creates an instance. You use the instance name when you associate the Cloud Identity Engine with Prisma Access in a later step. Optionally, if you need to create a separate instance for Prisma Access, create it and make a note of the instance name.
      2. Configure Azure Active Directory (Azure AD) in the Cloud Identity Engine to allow the Cloud Identity Engine to collect data from your Azure AD for policy enforcement and user visibility.
        To configure an Azure AD in the Cloud Identity Engine, you must have at least the following role privileges in Azure AD: Application Administrator and Cloud Application Administrator. For more information about roles in Azure AD, refer to the following link.
      3. Associate the Cloud Identity Engine with the Panorama app by logging in to the Palo Alto Networks hub and selecting the Panorama app.
      4. Complete the association by selecting the
        Cloud Identity Engine
         instance you want to associate with the app and click
        OK
        .
      5. From the Panorama that manages Prisma Access, find the serial number of the Panorama Explicit Proxy deployment by selecting the
        Dashboard
         and noting the
        Serial #
         that displays.
      6. Return to the Palo Alto Networks hub and select
        Panorama
        ; then, Find the serial number of the Panorama that manages Prisma Access, select it, then select
        Add Directory Sync
        .
      8. Return to the Panorama that manages Prisma Access, select or
        Panorama
        Cloud Services
        Configuration
        Mobile Users—GlobalProtect
         (for GlobalProtect deployments) or
        Panorama
        Cloud Services
        Configuration
        Mobile Users—Explicit Proxy
         (for explicit proxy deployments), select the gear icon to edit the
        Settings
        , then select
        Group Mapping Settings
        .
      9. Select
        Enable Directory Sync Integration
         to enable Cloud Identity Engine with Prisma Access; then, enter the following information and click
        OK
        :
        • Specify a
          Primary Username
           and
          E-Mail
           of
          mail
          .
        • Specify an
          Alternate User Name 1
           of
          userPrincipalName
          .
    12. Complete the configuration of Explicit Proxy or GlobalProtect in Panorama, including creating security policy rules to enforce your organization’s security policies and adding the PAC file to the browsers on your end users’ endpoints.
      See Secure Mobile Users with an Explicit Proxy (for explicit proxy) or Secure Mobile Users With GlobalProtect (for GlobalProtect) in the Prisma Access Administrator’s Guide (Panorama Managed) for details. If you have already configured Explicit Proxy, skip this step.
    13. Verify that SAML authentication is working with Explicit Proxy.
      1. Set up a tool to capture authentication-related SAML messages from the mobile user’s endpoint.
        Most supported browsers have a tool you can use to capture SAML messages, such as a browser extension or plugin.
        You can perform an internet search for SAML debugging tools to find a SAML tracer extension or plugin for your mobile user’s preferred browser.
      2. From a mobile user’s endpoint, authenticate from a supported browser.
        • GlobalProtect Deployments
          —Open the GlobalProtect app to find the GlobalProtect
          Portal
          ; then, enter the portal URL in a supported browser.
        • Explicit Proxy Deployments
          —Navigate from a supported browser to a website that is protected by Explicit Proxy.
      3. When you are challenged for authentication, verify that you are redirected to Azure AD and are presented with a login page.
        After you successfully authenticate to Azure AD, Azure AD redirects you to Prisma Access. Prisma Access then validates the SAML responses from Azure AD and the mobile user should be allowed to visit the website (for Explicit Proxy deployments) or you can successfully log in to the GlobalProtect portal (for GlobalProtect deployments).
      4. From Panorama, select
        Monitor
        Logs
         and verify that the mobile user’s username is displayed in the Traffic, URL Filtering, and Authentication logs.
      5. (
        Optional
        ) If the username is not displaying correctly in the logs, open a website that is protected by Explicit Proxy from another browser and capture the SAML response from Azure AD from that mobile user's browser using the tool you set up in Step #id625035b1-af11-44b4-a91a-a40a7ba67679_idcf6b758c-22af-4ef4-9178-a5848f5ede30.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.