Globalprotect SAML Authentication login screen does not load and shows blank page.
14879
Created On 12/27/22 10:01 AM - Last Modified 12/22/24 15:05 PM
Symptom
Globalprotect SAML Authentication login screen does not load and shows blank page while Enforce GlobalProtect Connection for Network access feature is set to Yes.
Environment
- Strata or Prisma Access firewalls
- Supported PAN-OS
- Globalprotect
Cause
- Enforce GlobalProtect for Network Access feature blocks the internet access.
- SAML authentication needs Internet Access to present login pages of Microsoft.
Resolution
- Navigate to GUI: Network > GlobalProtect > Portals > <portal-config> > Agent > <agent-config> > App.
- Click Add to add the URLs listed under "Allow traffic to specified hosts/networks when Enforce GlobalProtect Connection for Network Access is enabled and GlobalProtect Connection is not established".
* login.live.com
* *.msftauthimages.net
* *.msftauth.net
* autologon.microsoftazuread-sso.com
-
Ensure the latest URLs are aligned with Microsoft's best practice documentation, specifically those for "Azure portal authentication."
https://learn.microsoft.com/en-us/azure/azure-portal/azure-portal-safelist-urls?tabs=public-cloud
login.microsoftonline.com
*.aadcdn.msftauth.net
*.aadcdn.msftauthimages.net
*.aadcdn.msauthimages.net
*.logincdn.msftauth.net
login.live.com
*.msauth.net
*.aadcdn.microsoftonline-p.com
*.microsoftonline-p.com