MacOS users are unable to authenticate with latest OKTA SAML on the first attempt. Second attempt authentication is successful.
2160
Created On 08/10/23 05:18 AM - Last Modified 05/24/24 20:13 PM
Symptom
- Only macOS with GlobalProtect App is impacted.
- Only the first SAML auth attempt fails, subsequent attempts are successful.
- SAML login to Portal with Safari/Chrome browser works.
Environment
- Palo Alto Firewalls
- Supported PAN-OS
- macOS with GlobalProtect (GP) App
- SAML Auth
Cause
- The issue is on the SAML IDP side where it's not including Relay State information in the SAML Response (for example, OKTA IDP not sending RelayState when the binding method is POST)
- The issue can be narrowed down by taking the Fiddler capture or SAML tracer.
- The SAML Request sent by the GP Portal Firewall (#7422) has Relay State information:
- The SAML Response sent by the SAML IdP (#7477) has no Relay State information:
Resolution
- As a workaround, OKTA IDP recommends using the REDIRECT binding method on the SAML Service Provider (GlobalProtect Portal SAML authentication profile)
- Commit the configuration changes.
GUI: Device > Server Profiles > SAML Identity Provider