SSO Wrapping for Third-Party Credential Providers on Windows Endpoints

On Windows 7 endpoints, the GlobalProtect app utilizes the Microsoft credential provider framework to support single sign-on (SSO). With SSO, the GlobalProtect credential provider wraps the Windows native credential provider, enabling GlobalProtect to use Windows login credentials to automatically authenticate and connect to the GlobalProtect portal and gateway. In addition, SSO wrapping enables Windows 10 users to update their Active Directory (AD) password using the GlobalProtect credential provider when their password expires or an administrator requires a password change at the next login.
When other third-party credential providers also exist on the endpoint, the GlobalProtect credential provider is unable to gather the user's Windows login credentials. As a result, GlobalProtect fails to connect to the GlobalProtect portal and gateway automatically. If SSO fails, you can identify the third-party credential provider and configure the GlobalProtect app to wrap those third-party credentials, which enables users to successfully authenticate to Windows, GlobalProtect, and the third-party credential provider using only their Windows login credentials.
Optionally, you can configure Windows to display separate login tiles: one for each third-party credential provider and another for the native Windows login. This is useful when a third-party credential provider adds additional functionality that does not apply to GlobalProtect.
If you want to remove the GlobalProtect credential provider from your Windows endpoint, execute the GlobalProtectPanGPS.exe -u command in the Command Prompt.
Use the Windows registry or the Windows Installer (msiexec) to allow GlobalProtect to wrap third-party credentials:

Related Documentation