The Palo Alto Admin UI application from the Okta Integration Network (OIN) fails for Palo Alto firewalls configured in High Availability (HA) because the active configuration overwrites the passive configuration. Resolve this issue by creating and configuring a custom Security Assertion Markup Language (SAML) application within Okta to allow for the HA pair configuration. The OIN application lacks access to the feature that allows the application to request other Single Sign-On (SSO) URLs, causing the integration to fail for HA pairs.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN)
• High Availability (HA)
• Custom SAML Application Integration

The active Palo Alto configuration overwrites the passive Palo Alto configuration. The OIN application does not have access to the feature that allows the application to request other SSO URLs.

How is a custom SAML application configured for Palo Alto HA pairs?

Access the Okta Admin Console to create a custom SAML 2.0 application, configure the general and advanced SAML settings with the required Single Sign-On URLs, and map the necessary attribute statements for the Palo Alto firewalls.

NOTE: For the attributes to function correctly as listed in the instructions below, follow the Okta documentation for configuring SAML 2.0 for the Palo Alto Networks Admin UI when creating the custom SAML application integration.

1. Access the Okta Admin Console.
2. Navigate to Applications > Applications, and click Create App Integration.
3. Choose SAML 2.0 as the sign-in method and click Next.

4. Enter a name for the custom SAML application and click Next.

5. Complete the General settings section with the following information:

• • Single sign-on URL: <baseURL>/SAML20/SP/ACS
  • Audience URI: <baseURL>/SAML20/SP
  • Name ID format: Unspecified

6. Click Show Advanced Settings to expand the settings and configure the following options:

   • Response signed: Signed
   • Assertion signed: Signed
   • Signature algorithm: RSA_SHA256
   • Digest algorithm: SHA256
   • Assertion encryption: Unencrypted
   • If Single Logout (SLO) is required, upload a Signature Certificate and configure the following:
     • Single logout: Enabled
     • Single logout URL: <baseURL>/SAML20/SP/SLO
     • SP issuer: <baseURL>/SAML20/SP
   • Signed requests: Disabled
   • Requestable SSO URLs: Click Add Another and enter the URLs required for the environment. Ensure that each URL is included and represents the full SSO URL: <baseURL>/SAML20/SP/ACS
   • Authentication context class: PasswordProtectedTransport

7. Click Next
8. Check the box for This is an internal app that we have created if you do not wish to publicly release this app.
9. Click Finish

10. Under the Sign On tab, scroll down to the Attribute statements section, expand the Show legacy configuration section, and add the following attributes with the Name format set to Unspecified:  

    • Name: adminrole Value: appuser.adminrole
    • Name: domain Value: appuser.domain
    • Name: accessdomain Value: appuser.accessdomain

11. To send groups as part of the SAML assertion, configure the Group attribute statements section:

    • Name: groups
    • Name format: Unspecified
    • Select the appropriate filter from the dropdown menu and enter the preferred value.
    • Click Save

12. Click Next to complete the application creation.
13. Assign users or groups to the application and save the changes.
14. Configure the Palo Alto firewalls to use the custom SAML application in Okta for SSO.

Related References

• Palo Alto KB Article: Different SAML Profiles needed for Primary and Secondary devices in HA
• Okta Documentation: How to Configure SAML 2.0 for Palo Alto Networks Admin UI