Why is there no option to test SAML Authentication Profile from the CLI?
1763
Created On 06/12/23 07:58 AM - Last Modified 03/11/25 22:41 PM
Question
Why is there no option to test SAML Authentication Profile using CLI command below?
> test authentication authentication-profile ?
Environment
- Palo Alto Networks Firewall or Panorama
- PAN-OS 8.1 and above
- SAML Authentication Profiles
Answer
It is not possible to test a SAML authentication profile from the CLI due to the way SAML works.
SAML Authentication flow:
- Client connects to the Firewall (Service Provider or SP) and requests an Application
- Firewall redirects client to an Identity Provider (IdP) configured in the Authentication Policy
- User authenticates directly with the IdP
- IdP returns a SAML Assertion to the Client
- Client forwards the SAML Assertion to the Firewall
- Firewall validates the SAML Assertion
- Firewall grants access to the Application based on policy
As can be seen in this flow, the firewall is not the entity that performs the actual authentication it is only the Service Provider (SP). Instead, the client is redirected to the Identity Provider's (IdP) to authenticate directly.
It is not possible for the firewall to broker this entire process due to the direct authentication between Client and IdP. Because of this, SAML profiles will not be shown as an option in the CLI command:
> test authentication authentication-profile ?
Additional Information
10 Mar 25 (Vijay) - Article reviewed with Chris and published external.