Cookie Authentication on the Portal or Gateway
Cookie authentication simplifies the authentication process for end users because they will no
longer be required to log in to both the portal and the gateway in succession or enter
multiple OTPs for authenticating to each. This improves the user experience by
minimizing the number of times that users must enter credentials. In addition, cookies
enable use of a temporary password to re-enable VPN access after the user’s password
expires.
You can configure cookie authentication settings independently
for the portal and for individual gateways (for example, you can
impose a shorter cookie lifetime on gateways that protect sensitive
resources). After the portal or gateways deploy an authentication
cookie to the endpoint, the portal and gateways both rely on the
same cookie to authenticate the user. When the app presents the
cookie, the portal or gateway evaluates whether the cookie is valid
based on the configured cookie lifetime. If the cookie expires,
GlobalProtect automatically prompts the user to authenticate with
the portal or gateway. When authentication is successful, the portal
or gateway issues the replacement authentication cookie to the endpoint,
and the validity period starts over.
Consider the following example where you configure the cookie lifetime for the portal—which does
not protect sensitive information—as 15 days, but configure the cookie lifetime for
gateways—which do protect sensitive information—as 24 hours. When the user first
authenticates with the portal, the portal issues the authentication cookie. If the user
attempted to connect to the portal after five days, the authentication cookie would
still be valid. However, if the user attempted to connect to the gateway after five
days, the gateway would evaluate the cookie lifetime and determine it expired (5 days >
24 hours). The agent would then automatically prompt the user to authenticate with the
gateway and, on successful authentication, receive a replacement authentication cookie.
The new authentication cookie would then be valid for another 15 days on the portal and
another 24 hours on the gateways.
