Configuring SSO for GlobalProtect VPN with PingFederate

Sign on to Palo Alto Networks NGFW as an administrator, and then go to the Device tab.

To import the metadata from PingFederate, go to Server Profiles → SAML Identity Provider, and then click Import.

Enter a name in the Profile Name field, and then click Browse and select the metadata.xml file from step 7 of Exporting the SAML Metadata from PingFederate.

Optional: If you are using a self-signed certificate in PingFederate, clear the Validate Identity Provider Certificate check box.

Click OK.

Click on your newly-created profile to open it.

Select the Post check box for both SAML HTTP Binding for SSO Requests to IDP and SAML HTTP Binding for SLO Requests to IDP.

Optional: Adjust the clock skew in the Maximum Clock Skew (seconds) field.

Click OK.

In Palo Alto Networks NGFW, go to the Device tab, and then click Authentication Profile.

Click Add, and enter a profile name in the Name field.

From the Type list, select SAML.

From the IdP Server Profile list, select the SAML profile from step #/server_profile.

From the Certificate for Signing Requests list, select the certificate of your GlobalProtect portal that you have created prior to this configuration. This will be used to sign the SAML message to the IdP.

From the Certificate Profile list, select the certificate profile that you have created prior to this configuration.

Go to the Advanced tab, and then click Add.

Select the groups that you want to be included in this Authentication Profile, and then click OK.

In Palo Alto Networks NGFW, go to Network → GlobalProtect → Portals, and then select the portal that you want to configure.

Under Server Authentication, select the ssl service profile to the portal.

Under Client Authentication, click Add.

In the Client Authentication window, enter a name in the Name field. From the Authentication Profile list, select the authentication profile from step #/auth-profile.

Optional: From the Allow Authentication with User Credentials OR Client Certificate list, select Yes.

Click OK.

Go to the Agent tab and set the trusted root CA.

Under Agent, click Add.

On the Authentication tab, enter a name in the Name field. From the Save User Credentials list, select Save Username Only.

Go to the External tab. Under External Gateways, click Add.

Enter a name in the Name field, and then enter the FQDN or IP address for the agent.

Go to the App tab and review your configuration. Make any changes if required, and then click OK.

Click the Metadata link of the authentication profile from step #/auth-profile.

From the Service list, select global-protect.

From the Virtual System list, select the virtual system.

In the IP or Hostname field, select the URL of your GlobalProtect portal, and then click OK.

In the PingFederate administrative console, go to Applications → Integration → SP Connections, and then click Create Connection.

On the Connection Template tab, select Do Not Use a Template for This Connection, and then click Next.

On the Connection Type tab, select the Browser SSO Profiles check box, and select SAML 2.0 from the Protocol list. Click Next.

On the Connection Options tab, accept the default election and click Next.

On the Import Metadata tab, select the File check box and then click Choose File. Select the NGFW metadata file from step 4 of Configuring a SAML Integration with PingFederate in NGFW, and then click Next.

On the Metadata Summary tab, ensure the imported EntityID field is correct, and then click Next.

On the General Info tab, review the imported Base URL field, and then click Next.

On the Browser SSO tab, click Configure Browser SSO.

On the SAML Profiles tab, select the SP-Initiated SSO check box, and then click Next.

On the Assertion Lifetime tab, accept the default values and click Next.

On the Assertion Creation tab, click Configure Assertion Creation.

Click Next until you reach the Authentication Source Mapping tab, accepting the default values.

On the Authentication Source Mapping tab, an Adapter Instance or Authentication Policy Contract must exist. Click Map New Adapter Instance.

On the Adapter Instance tab, select HTML Form Adapter from the Adapter Instance list, and then click Next.

On the Mapping Method tab, accept the default values and click Next.

On the Attribute Contract Fulfillment tab, select Adapter from the Source list and select username from the Value list. Click Next.

Click Next and Done until you return to the Protocol Settings tab, accepting the default values. Click Configure Protocol Settings.

On the Assertion Consumer Service URL tab, ensure that the Endpoint URL is correct, and then click Next.

On the Allowable SAML Bindings tab, select POST and then click Next.

Click Next and Done until you return to the Credentials tab. Click Configure Credentials.

On the Digital Signature Settings tab, select a signing certificate from the Signing Certificate list. Click Done.

On the Credentials tab, click Next.

On the Activation & Summary tab, ensure your connection is enabled with the green toggle switch, and then click Save.