Resolve the You Are Not Authorized to Connect to GlobalProtect Portal Error in Okta
Last Updated:
Overview
An authorization error occurs when users attempt to log in to the Palo Alto GlobalProtect application because group mappings or attributes fail to pass correctly from Okta. Configuring a custom application username format in the Okta Admin Console resolves this issue. The following error message appears when users attempt to log in:
You are not authorized to connect to GlobalProtect Portal
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Palo Alto GlobalProtect
Cause
GlobalProtect authentication fails when group mappings are incorrect or when group attributes fail to pass between Okta and GlobalProtect. Additionally, GlobalProtect configuration issues, such as an incorrectly configured authentication profile, gateway agent issues, or mismatched authentication settings between Okta and GlobalProtect, cause this error.
Solution
How is the GlobalProtect Portal authorization error resolved?
Configure a custom application username format for the Palo Alto GlobalProtect Security Assertion Markup Language (SAML) application in the Okta Admin Console to ensure successful authentication.
- Navigate to the Okta Admin Console.
- Go to the Palo Alto GlobalProtect application.
- Select the Sign On tab.
- Select Custom from the Application username format dropdown menu and enter the following format:
"domain" + toLowerCase(active_directory.samAccountName)-
Select Save
Administrators must contact Okta Support for additional assistance if the error persists.
