Exchange SAML Metadata

Let us learn how the exchange of SAML metadata works.
Metadata exchange between Palo Alto Networks Service Provider (SP) and your IdP occurs prior to enabling SAML. Palo Alto Networks requires contact information of the person responsible for authorizing SAML setup.
Only support_admin or support_super users can set up SSO using SAML. Ensure you have the required set of permissions and privileges to initiate the SAML setup.
  1. Palo Alto Networks provides Service Provider (SP) metadata
    <sp_meta_data_file>
    to configure within your IdP system.
    The communication between the Service Provider and the IdP is part of the pre-setup configuration outside of the Prisma SD-WAN web interface using emails.
  2. Import the Palo Alto Networks Customer Support provided SP metadata into your IdP system.
  3. Generate your IdP metadata
    <idp_meta_data_file>
    and provide it to Palo Alto Networks Customer Support.
  4. Provide custom role-mapping instructions to Palo Alto Networks, if any.
    If you require custom role mapping, you must provide group names and role mapping instructions to Palo Alto Networks.
    If you decide to use Palo Alto Networks groups, you must tag your end users with Palo Alto Networks groups in your IdP system. Create Palo Alto Networks suggested groups within your IdP system and add end users to the groups to access the Prisma SD-WAN web interface. Or provide group-to-role mapping instructions to Palo Alto Networks to configure in the Prisma SD-WAN web interface.
  5. Palo Alto Networks receives and configures the IdP metadata in the Prisma SD-WAN web interface.
    After the above process is complete, SAML is enabled. See Palo Alto Networks and IdP metadata to view sample Palo Alto Networks and IdP metadata.
    Only an IAM Admin, Super, or Root user, whose email domain matches the SAML domain, can modify
    AAA Configuration
    using the Prisma SD-WAN web interface, other than Palo Alto Networks Customer Support.

Recommended For You