SAML 2.0 Authentication for GlobalProtect

Configure SAML 2.0 Authentication on the PAN-OS firewall that hosts the portal or gateway.

Create a server profile with settings for access to the SAML 2.0 authentication service.
Create an authentication profile that refers to the SAML server profile.

(

Optional

) Configure a GlobalProtect gateway.

Specify SAML authentication for gateway users:

Select
Authentication Profile
and add the SAML authentication profile you created in step 1. This profile is used to authenticate an endpoint seeking access to the gateway.
For iOS clients, SAML authentication is only supported when the
Connect Method
is configured for
On-demand (Manual user initiated connection)
.
Enter an
Authentication Message
to help end users understand which credentials to use when logging in. The message can be up to 100 characters in length (default is
Enter login credentials
).

(

Optional

) Select a

Certificate Profile

to use for client authentication to the gateway. For the certificate profile you select, make sure the

Username Field

in the certificate profile is set to

None

.



(

Optional

) Define the GlobalProtect Client Authentication Configurations on the GlobalProtect portal.

Specify SAML authentication for the client:

Select
Authentication Profile
and add a SAML authentication profile. You can use the same profile you created in step 1 or create a new SAML profile for the portal. This profile is used to authenticate an endpoint seeking access to the portal.
Enter an
Authentication Message
to help end users understand which credentials to use when logging in. The message can be up to 100 characters in length (default is
Enter login credentials
).

(

Optional

) Select a

Certificate Profile

to use for client authentication to the portal. For the certificate profile you select, make sure the

Username Field

in the certificate profile is set to

None

.