Captive Portal Authentication fails with "User not in allow list" for SAML Authentication Profile
8875
Created On 07/19/22 13:53 PM - Last Modified 04/22/24 07:45 AM
Symptom
- Authentication will fail with User is not in Allow List
- Authd.log will show the below logs when authentication failed
pan_auth_cache_user_is_allowed(pan_auth_cache_allowlist_n_grp.c:786): user "user1@sarad.com" is NOT in allow list of auth prof/vsys "SAML Okta-captive portal test/vsys1" (vsys in request "vsys1")
Environment
- GlobalProtect/Captive Portal
- SAML Authentication profile configured under Shared location
- PAN-OS version 10.1.0 and above
Cause
- Issue is seen when the authentication profile is configured as shared but the response is copied with the vsys value as vsys1. The vsys value is populated from the request instead of copying from get_saml_info
Resolution
- Configure SAML Authentication profile under specific vsys instead of the shared location
Additional Information
Authentication Profile (paloaltonetworks.com)