Prisma browser does not sync users from CIE, in which the users are successfully integrated from DUO IDP to CIE

Prisma browser does not sync users from CIE, in which the users are successfully integrated from DUO IDP to CIE

244
Created On 10/16/25 13:30 PM - Last Modified 01/16/26 03:40 AM


Symptom


  • The user's login display shows the error: "Invalid username and password" 
  • The authentication profile created in the Cloud Identity Engine is specified in Strata Cloud Manager->Configuration->Prisma access browser -> Onboarding ->Users  ->Authentication profile
  • The users expected to be learned from the Cloud Identity Engine are not visible in Strata Cloud Manager->Configuration->Prisma access browser -> Users despite the fact that they were successfully learned by the Cloud Identity Engine from the DUO IDP.
  • The users created in the local Cloud Identity Engine directory are visible in Strata Cloud Manager->Configuration->Prisma access browser -> Users.


Environment




Cause


  • The DUO IDP provided the usernames to the cloud identity engine without the common name(CN) attribute, while other 3 major attributes were present. 
  • The Prisma browser does not support the IDP vendors that does not provide the following attributes to Cloud Identity Engine: 
Common-Name - The user's display name
Unique Identifier - The user's ObjectGUID (primary key)
Mail - The user's email address
User Principal Name - The user's UPN


Resolution


  1. Modify the The DUO IDP server to include the Common Name( CN ) when sharing the user's information to Cloud Identity Engine.
  2. Upon the presence of all the mandatory attributes, the Prisma browser database sync's all users present in Cloud Identity Engine
  3. The user sync from Cloud Identity Engine can be viewed by navigating to Strata Cloud Manager->Configuration->Prisma access browser -> Users.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000fyKwKAI&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail