Let the self-signed CA issue a certificate.Įdit the config and enable SLO which is optional but I’d recommend doing it for the sake of following this guide.ĭownload the metadata (right click > save as …) An IP address should be sufficient if you do not have a domain name. The other one is for RADIUS authentication.Įnter the URL to your GlobalProtect as your “Base URL”.

Okta’s AD-Agent installed and fully sync’ed with Okta.

LDAP integration within the Palo Alto (see my previous post).

GlobalProtect Portal/Gateway configured.

In a previous post, we’ve configured RADIUS for GlobalProtect VPN which obviously lacks the SSO beauty. When the user tries to access an application or to be specific a service provider, it’ll forward the request to an Identity Provider (Okta for example) and back to the application (service provider). It’s based on the XML Protocol that uses security tokens containing assertions. SAML allows secure SSO (Single-Sign-On) authentication which means that users only have to log in once.

This would lead to all kinds of issues like when the user starts writing their passwords down on a piece of paper hidden under a keyboard. Imagine the hassle when a particular user has to login multiple times a day and remember different login/passwords and the organization resets passwords every so often.

Palo alto globalprotect setup