Authentication is a critical aspect of securing remote access to your organization's resources. Prisma Agent provides multiple authentication methods to verify user identities before granting access to protected resources. While Prisma Agent has traditionally relied on Cloud Identity Engine (CIE) for authentication through Security Assertion Markup Language (SAML) and client certificates, many organizations require Lightweight Directory Access Protocol (LDAP)/LDAPS authentication support.

The LDAP authentication capability for Prisma Agent enables organizations to use existing directory services infrastructure integrated with the GlobalProtect® Portal. This integration provides a smooth transition path for you to migrate existing deployments from GlobalProtect to Prisma Agent without having to reconfigure your authentication methods or adopt new authentication workflows.

When you enable LDAP authentication, Prisma Agent communicates with the GlobalProtect Portal for user validation instead of directly connecting to the Cloud Identity Engine. The agent receives the GlobalProtect Portal fully qualified domain name (FQDN) from the Prisma Agent management plane, connects to the Portal, and presents the user with credential prompts. Upon successful authentication against your LDAP directory, the Portal grants Prisma Agent an authentication override cookie that is validated by the management plane, which then issues the appropriate access tokens.

By default, LDAP users gets prompted for authentication every 24 hours. You can set up LDAP authentication for Strata Cloud Manager Managed Prisma Access deployments or Panorama Managed Prisma Access or Next-Generation Firewall (NGFW) deployments.