Configure ADFS on the ADFS Server

1. Retrieve the list of URLs associated with the cloud-based portals and gateways.

   1. In Panorama, select PanoramaCloud ServicesStatus, then select Mobile Users.
   2. Copy the URLs of the Portals and Gateways that display.

2. Add each Prisma Access portal and gateway as a Relying Party Trust to the Windows server.

   1. On the server running AD FS, start AD FS Management.
   2. In the Navigation Pane, expand Trust Relationships, and then select Relying Party Trusts.
   3. On the Actions menu located in the right column, select Add Relying Party Trust.
   4. In the Add Relying Party Trust Wizard page, select Claims aware and click Start.

   5. In the Select Data Source page, select Enter data about the relying party manually and click Next.

   6. In the Specify Display Name page, enter the name for the first relying party (one of the Prisma Access gateways or portals) and click Next.

      This example specifies one of the cloud Gateways from Prisma Access as a relying party.

   7. In the Configure URL page, enter the SAML single sign-on URL for the gateway; then click Next.

      The URL is in the format https://<gateway-hostname>:443/SAML20/SP/ACS, where <gateway-hostname> is the name of the Prisma Access gateway you are configuring as a relying party trust.

   8. In the Configure Identifiers page, enter the relying party trust identifier for the gateway; then click Next.

      The relying party trust identifier URL is in the format https://<gateway-hostname>:443/SAML20/SP, where <gateway-hostname> is the name of the Prisma Access gateway you are configuring as a relying party trust.

   9. In the Choose Access Control Policy page, leave the Policy as Permit everyone and click Next.

   10. Click Finish.

       ADFS adds a new Relying Party Trusts entry.

3. Add a rule to the relying party trust you created.

   1. In the Relying Party Trusts page, find the gateway you just added in the selections on the right, then select Edit Claim Issuance Policy.

   2. In the Edit Claim Issuance Policy page, click Add Rule.

   3. In the Select Rule Template page, select Send LDAP attributes as Claims as the Claim rule template and click Next.

   4. In the Configure Rule window, add an LDAP Attribute of SAML-Account-Name and an Outgoing Claim Type of Name ID.

      By default, the Prisma Access portal and gateways expect to see the username attribute in the SAML response from the Identity Provider (IdP).

   5. Click Apply then click OK.

      The gateway displays in the list of Relying Party Trusts.

4. (Optional) If you use a certificate issued by a Certificate Authority (CA), add it as a token signing certificate and enable IdP provider certificate validation on ADFS.

   1. Generate a certificate using your enterprise CA.
   2. Add the token signing certificate on ADFS.

      Use the instructions on the Microsoft website to add the certificate.

5. Add all the gateways and portals in Prisma Access as Relying Party Trusts by completing Step 2 and Step 3 for the remaining Prisma Access portals and gateways.