Let us learn how the exchange of SAML metadata works.
Metadata exchange between Palo Alto Networks
Service Provider (SP) and your IdP occurs prior to enabling SAML.
Palo Alto Networks requires contact information of the person responsible for
authorizing SAML setup.
Only support_admin or support_super
users can set up SSO using SAML. Ensure you have the required set
of permissions and privileges to initiate the SAML setup.
Palo Alto Networks provides Service Provider (SP)
within your IdP system.
The communication between the Service Provider and
the IdP is part of the pre-setup configuration outside of the Prisma
SD-WAN web interface using emails.
Import the Palo Alto Networks Customer Support provided
SP metadata into your IdP system.
Generate your IdP metadata
provide it to Palo Alto Networks Customer Support.
Provide custom role-mapping instructions to Palo Alto
Networks, if any.
If you require custom role mapping, you must provide group
names and role mapping instructions to Palo Alto Networks.
If you decide to use Palo Alto Networks groups, you must
tag your end users with Palo Alto Networks groups in your IdP system.
Create Palo Alto Networks suggested groups within your IdP system
and add end users to the groups to access the Prisma SD-WAN web
interface. Or provide group-to-role mapping instructions to Palo Alto
Networks to configure in the Prisma SD-WAN web interface.
Palo Alto Networks receives and configures the IdP metadata
in the Prisma SD-WAN web interface.
After the above process is complete, SAML is enabled. See
Palo Alto Networks and IdP metadata to view sample Palo Alto Networks
and IdP metadata.
Only an IAM Admin, Super, or Root user, whose email
domain matches the SAML domain, can modify
the Prisma SD-WAN web interface, other than Palo Alto Networks Customer