Single Sign-On (SSO) Using Smart Card Authentication

1. Set the pre-deployed setting on Windows endpoints to use SSO for smart card authentication.
   You must set the pre-deployed setting on the end user endpoints before you can enable SSO for smart card PIN. GlobalProtect retrieves this entry only once, when the GlobalProtect app initializes.
   If the USESSOPIN value is set to yes in the pre-deployed setting of the client machine and the Use Single Sign-On for Smart Card PIN (Windows) option is set to no in the portal configuration, end users will not have the best user experience. The Use Single Sign-On for Smart Card PIN (Windows) option of the GlobalProtect portal and the pre-deployed setting in the end user machine must have the same value to provide the best user experience.

   If you set both Use Single Sign-On (Windows) and Use Single Sign-On for Smart Card PIN (Windows) options to yes in the portal configuration, the Use Single Sign-On for Smart Card PIN (Windows) option takes precedence over the Use Single Sign-On (Windows) option.
   On Windows endpoints, set the USESSOPIN value to yes from the Windows Installer (Msiexec) using the following syntax:

   msiexec.exe /i GlobalProtect64.msi USESSOPIN="yes"

2. Set up the smart card for two-factor authentication.
   1. Assign the certificate profile associated with the smart card to the GlobalProtect portal.
   2. Configure the gateway to authenticate end users based on a smart card.
3. Enable the GlobalProtect app so that end users can leverage the same smart card PIN for GlobalProtect with their Windows endpoint.
   1. Select NetworkGlobalProtectPortals<portal-config>Agent<agent-config>AppUse Single Sign-On for Smart Card PIN (Windows).
   2. Select Yes to enable the GlobalProtect app to use SSO for smart card PIN.

4. Click OK twice.
5. Commit the configuration.
6. Log in to the Windows endpoint using the smart card PIN.
   1. Click Sign-in options, and then click the smart card (
      ) button.
   2. When prompted, insert the smart card to verify that smart card authentication is successful.

   3. Enter the PIN for the smart card, and click the arrow to submit.
      If smart card authentication is successful, end users can connect to the portal or gateway specified in the configuration without having to re-enter their smart card PIN.

7. (Optional) Log in to GlobalProtect using the same smart card PIN.
   End users can leverage the same smart card PIN that they used to log in to their Windows endpoint.
   1. Launch the GlobalProtect app by clicking the system tray icon. The status panel opens.
   2. Click the hamburger menu to open the Settings panel.
   3. On the Settings panel, Sign Out to clear your saved user credentials from the GlobalProtect app.
   4. Reconnect to GlobalProtect with the same smart card PIN.
      The GlobalProtect app displays a smart card PIN error if the PIN is not valid.