Prisma Access
Cloud Management
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
SAML Authentication Using Okta as IdP for Mobile Users (Strata Cloud Manager)
Strata Cloud Manager
)Configure Prisma Access to establish a trust relationship with your Okta IdP for SAML
2.0 authentication of your mobile users.
Use the following procedure to configure a trust relationship between Prisma Access
and your Okta IdP:
- Complete the steps for defining the Service Provider (SP) settings, including generating or importing the certificate that Prisma Access uses to sign SAML messages that it sends to the identity provider (IdP).
- Export the Prisma Access signing certificate so that you can import it onto your IdP.
- Log into Okta as an administrator and create and create SAML 2.0 applications for Prisma Access.
- Create a new application integration for Prisma Access. Specify the Platform Type asWeband the sign-on method asSAML 2.0and clickCreate.
- Configure the following application integration options:
- Single sign on URL—Enter the URL for the portal (i.e. https://portal114.gpcloudservice.com:443/SAML20/SP/ACS)
- Use this for Recipient URL and Destination URL—Select this check box.
- Allow this app to request other SSO URLs—Select this check box and add the URLs for all Prisma Access gateways on the list you copied in theRequestable SSO URLsfield.
- Audience URI (SP Entity ID)—Enter the URL for the portal (i.e. https://portal114.gpcloudservice.com:443/SAML20/SP).
- Default RelayState—Leave blank.
- Name ID format—SelectEmailAddress.
- Application username—SelectOkta Username.
- SelectShow Advanced Settingsand configure these settings:
- Allow application to initiate Single Logout—Select this check box.
- Single Logout URL—Enter https://<Prisma Access-FQDN>:443/SAML20/SP/SLOWhere<Prisma-Access-FQDN>is the FQDN you defined for Prisma Access when you set up the environment.
- SP Issuer—Enter the issuer for the service provider.
- Signature Certificate—Browseto and then select the SAML signing certificate that you exported from Prisma Access, then clickUpload Certificate.
- In the ATTRIBUTE STATEMENTS (OPTIONAL) area, specify users, Name formats, and values in Okta Expression Language.These fields reference, transform and combine attributes to define the Username attribute format to match what you set up on Prisma Access. For example, specify a name format ofBasicand a Value ofuser.firstName.
- Optionally, in the Group Attribute Statements (Optional) area, create group attribute options.You can’t use group information that’s retrieved from the SAML assertion in either security policy rules or the GlobalProtect app configuration.
- Save the configuration.
- Complete the configuration of the SAML 2.0 web application in Okta and enable the users to use the application. ClickView Setup Instructionsfor details.
- To download the metadata files for the portal and gateways, clickIdentity Provider metadataand copy that information.
- Import the metadata file and the CA certificate from Okta into Prisma Access.
- Log in to the Prisma Access app on the hub and go to. SelectWorkflowsPrisma Access SetupMobile UsersGlobalProtect SetuporExplicit Proxy Setupand edit theUser Authenticationconfiguration.
- InSAML IdP ProfileclickAdd SAML IdP ProfileandImportthe metadata file you exported from the Okta server.
- Savethe IdP profile.