This article addresses an issue where users fail to authenticate when using the Palo Alto GlobalProtect VPN client and provides a resolution to the issue. This situation occurs specifically within the VPN client application and does not apply to browser-based sessions. This failure happens when the client is configured to use an embedded browser for authentication instead of the default system browser.

The following error is generated:

Authentication Failed

Please contact the administrator for further assistance

• Palo Alto GlobalProtect VPN client
• SAML authentication

The Palo Alto GlobalProtect VPN client is configured to use an internal embedded browser for SAML authentication, which fails to complete the authentication process. Switching to the default system browser resolves this incompatibility.

Follow the steps in the vendor documentation Use the Default System Browser for SAML Authentication to switch the VPN client from the embedded browser to the default system browser.