Deploying MultiFactor authentication for GlobalProtect with Azure SAML looks quite easy from documentation perspetive, but how it looks like from practical perspective.
I deployed it couple times and faced some issues which aren’t documented well and I had to find out myself how to achive goals.
Generally, what and how to configure is described below, quite well:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE
Issue #1 User-ID
Often as match criteria in security policy users groups are used as source. Firewalls has to monitor Active Directory for users group membership. It didn’t work for some users.
I found that Active Directory user format is company\user, but Azure SAML sent user as user@company, so from group mapping perspective it is completly different user. As a result, policies based on users groups didnt’t work.
To debug above SAML-tracer chrome extension was used.
Azure SAML app doesn’t provide ability to change user format. It was solved using Palo Alto Networks firewall capability (thanks to PANW flexibility again).
Using Group Mapping settings we can specify the attribute the User-ID source provides for the username from Active Directory attribiutes:
Above means that firewall will map user format as mail, UserPrincipalName to sAMAccountName as a main user. To verify user group mapping:
As seen above, user in different formats was mapped to the main one and voilà, security policies based on users groups can be used.
Issue #2 Migartion
How to do it transparently as mauch as possible for users – I ahd to migrate more than 2000 users to GlobalProtect with MFA. Enabling MFA at once means a lot of support request, even when proper communications was sent across company.
I decided to configure GlobalProtect Portal and Gateway on new ip address, added as secondary to the same interface. As a result, at once both GlobalProtect doors were accessible, the old one without MFA and new one with MFA.
Migration steps (not well documented).
- Disable agent SSO if enabled to remove credentials cache.
- Wait some time until all clients receive above settings.
- Change portal address via Windows Registry using GPO, use exactly same order
- Reboot machine.
Simple, right now:) But required a lot of testing and troubleshooting.