Cookie Authentication on the Portal or Gateway
Cookie authentication simplifies the authentication
process for end users because they will no longer be required to
log in to both the portal and the gateway in succession or enter multiple
OTPs for authenticating to each. This improves the user experience
by minimizing the number of times that users must enter credentials.
In addition, cookies enable use of a temporary password to re-enable
VPN access after the user’s password expires.
You can configure cookie authentication settings independently
for the portal and for individual gateways (for example, you can
impose a shorter cookie lifetime on gateways that protect sensitive
resources). After the portal or gateways deploy an authentication
cookie to the endpoint, the portal and gateways both rely on the
same cookie to authenticate the user. When the app presents the
cookie, the portal or gateway evaluates whether the cookie is valid
based on the configured cookie lifetime. If the cookie expires,
GlobalProtect automatically prompts the user to authenticate with
the portal or gateway. When authentication is successful, the portal
or gateway issues the replacement authentication cookie to the endpoint,
and the validity period starts over.
Consider the following example where you configure the cookie
lifetime for the portal—which does not protect sensitive information—as
15 days, but configure the cookie lifetime for gateways—which do
protect sensitive information—as 24 hours. When the user first authenticates
with the portal, the portal issues the authentication cookie. If
after five days, the user attempted to connect to the portal, the
authentication cookie would still be valid. However, if after five
days the user attempted to connect to the gateway, the gateway would
evaluate the cookie lifetime and determine it expired (5 days >
24 hours). The agent would then automatically prompt the user to
authenticate with the gateway and, on successful authentication, receive
a replacement authentication cookie. The new authentication cookie
would then be valid for another 15 days on the portal and another
24 hours on the gateways.
