Global Protect agent prompts to enter credentials after password change

•  Any GlobalProtect App version
•  Any PAN-OS
•  Pre-logon (Always On) with Save User Credentials set to "Yes"
•  Single Sign-On (SSO) Configured

• When SSO is configured along with Save User Credentials set to "Yes", we will witness the following behavior:
  • Portal: We will use SSO first and then fallback to saved credentials
  • Gateway: We will use the saved credentials first, and then fallback to the SSO provided credential

If SSO is in use then it is not necessary to save the user's credentials when connecting to the GlobalProtect Portal and/or Gateway, so we may use the following steps to configure it as "No":

1.  Navigate to Network > GlobalProtect > Portals > "Select the Portal"
2.  On the Agent tab, select the appropriate agent configuration which populates the Authentication tab dialog box
3.   Locate the "Save User Credentials" configuration option and select No from the dropdown menu
4.  Select OK to exit the Authentication tab dialog box
5.  Select OK again to exit the GlobalProtect Portal Configuration tab dialog box
6.  Select Commit to save your configuration changes

For additional information regarding SSO and GlobalProtect authentication, please refer to the following links:

•  GlobalProtect Portals Agent Authentication Tab
•  Customize the GlobalProtect App
•  Tips & Tricks: Single Sign-On (SSO) for GlobalProtect
•  Configure SAML Authentication
•  About GlobalProtect User Authentication