Prisma browser does not sync users from CIE, in which the users are successfully integrated from DUO IDP to CIE
244
Created On 10/16/25 13:30 PM - Last Modified 01/16/26 03:40 AM
Symptom
- The user's login display shows the error: "Invalid username and password"
- The authentication profile created in the Cloud Identity Engine is specified in Strata Cloud Manager->Configuration->Prisma access browser -> Onboarding ->Users ->Authentication profile
- The users expected to be learned from the Cloud Identity Engine are not visible in Strata Cloud Manager->Configuration->Prisma access browser -> Users despite the fact that they were successfully learned by the Cloud Identity Engine from the DUO IDP.
- The users created in the local Cloud Identity Engine directory are visible in Strata Cloud Manager->Configuration->Prisma access browser -> Users.
Environment
- The Cloud Identity Engine is integrated with the DUO IDP using a SCIM Connector
- Prisma browser integrated with Cloud Identity Engine
Cause
- The DUO IDP provided the usernames to the cloud identity engine without the common name(CN) attribute, while other 3 major attributes were present.
- The Prisma browser does not support the IDP vendors that does not provide the following attributes to Cloud Identity Engine:
Common-Name - The user's display name
Unique Identifier - The user's ObjectGUID (primary key)
Mail - The user's email address
User Principal Name - The user's UPNResolution
- Modify the The DUO IDP server to include the Common Name( CN ) when sharing the user's information to Cloud Identity Engine.
- Upon the presence of all the mandatory attributes, the Prisma browser database sync's all users present in Cloud Identity Engine
- The user sync from Cloud Identity Engine can be viewed by navigating to Strata Cloud Manager->Configuration->Prisma access browser -> Users.