<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Helvetica;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Helvetica">We found that we couldn't use ShibSP, but the GlobalProtect server could be configured for SAML using its own built-in SAML implementation and internal browser (that is not great)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Helvetica"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;color:black">From:
</span></b><span style="font-family:"Calibri",sans-serif;color:black">users <users-bounces@shibboleth.net> on behalf of IAM David Bantz <dabantz@alaska.edu><br>
<b>Reply-To: </b>Shib Users <Users@shibboleth.net><br>
<b>Date: </b>Thursday, January 21, 2021 at 14:42<br>
<b>To: </b>"Users@shibboleth.net" <Users@shibboleth.net><br>
<b>Subject: </b>Shibb for Global Protect VPN?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">UAlaska has deployed VPN access using Global Protect. If I understand correctly, VPNs are (or can be) initiated in a web portal. If so, seems one could protect that web page with Shibb and thus have a valid SSO session immediately upon
establishment of VPN connection (at least if IP address consistency is not enforced). I’ve been asked about that scenario by alert users. Has anyone tried that and willing to share experience? Or perhaps disabuse me of its feasibility?<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">David St. Pierre Bant<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">UAlaska IAM<o:p></o:p></p>
</div>
</div>
</body>
</html>