Please let me know if this is useful. In case it is, then this could be published with the images in our public portal ... View more

You can configure custom attributes for users in GSuite. You could possibly include group information in custom attributes. Below is a procedure that is copied from my article long back, but things might have changed. Please let me know if this works for you.   How to create custom attributes in G Suite Following is the procedure to create SAML custom attributes in G Suite: Go to admin.google.com and login as Administrator of an account Click on Main Menu   , and then on Users   Click on Manage attributes button  Notice the User attributes page opens up (as shown below): There, click on ADD CUSTOM CATEGORY (lower left) Enter Attribute values as shown below (rather something similar): Click on Save Then, click on a user in the list Click on Account Click on Manage user attributes -> Edit link Enter a value for the attribute as below: Click on UPDATE USER Go to your SAML App (from main window of admin.google.com -> Apps -> SAML Apps -> <your configured App>) Click on Attribute Mapping and then on ADD NEW MAPPING Enter the following details: Configuring PSA Box to use the attribute Below is the procedure to use the above attribute in SP configured at PSA (It is assumed that PSA's SP Configuration is al-ready done): Go to Authentication -> Auth. Servers -> <configured SAML Server> Click on the box beside User Name Template and enter the following: Click on Save Changes Login using any standard browser, to your SAML endpoint at PSA Notice the following appears at the user name section:   Configuring mapping of SAML attributes to Roles in PSA Box   SAML User attributes can also be mapped to Roles at the PSA Box. This would make it easier for providing more flexible and granular access control rules over the SAML subject. This can be done as follows: Go to Users -> User Realms -> SAML Realm Click on Role Mapping Click on New Rule Select Custom Expressions beside Rule based on text, and click on Update Enter a name beside Name section Click on the Expressions button A new popup will be opened, with the Expressions creation procedure Enter a name in the Name section Under the Expressions Dictionary, select userAttr.<auth-attr> Select an operator (preferably =) Click on Insert Expression In the Expression box, the following would appear: userDN.<user-attr> = <ANY>  Change it to as follows: userDN.my_map = 'Pulse Secure Desktop QA Team' Click on Add Expression Click on Add -> beside the Available Expressions box Select SAML Role, and click on Add -> box Click on Save Changes Now login to the SAML endpoint of PSA, and then, to the G Suite login page Notice that if the user has an attribute with value Pulse Secure Desktop QA Team, she is allowed to login ... View more

The following is the log spew for a successful login through GSuite (please read from bottom to top):   VPN Tunneling: User with IP 10.168.8.12 connected with ESP transport mode. Key Exchange number 1 occurred for user with NCIP 10.168.8.12 VPN Tunneling: Session started for user with IPv4 address 10.168.8.12, hostname psecure-virtual-machine VPN Tunneling: Optimized ACL count = 2. VPN Tunneling: ACL count = 2. Connected to TUN-VPN port 443 Login succeeded for Engineer, Pulse Secure Desktop QA Team/G Suite Realm (session:a1d3fba7) from 192.168.8.17 with DSClient; PulseLinux. Primary authentication successful for Engineer, Pulse Secure Desktop QA Team/G Suite SAML Authentication Server from 192.168.8.17 SAML Consumer received and processed 'Post' Result:SUCCESS SAML AuthnRequest generation succeeded for SigninUrl:'https://myfqdn.com/gsuite_saml', SSO Service URL: 'https://accounts.google.com/o/saml2/idp?idpid=xxxxxxxx'   The SAML AuthnRequest generation message is the first one (last line above). This should be followed by something like SAML Consumer received and processed 'Post' Result:SUCCESS. Do you see such a sequence of messages? ... View more

Hi Kali,   Looks like the script that is being run while connecting to VPN, expects some sort of a file in the partition that you had changed. May be it is collecting some information from some file in that partition   ... View more

Hi,   Yes, that is where it is set (User Realms > Test_SAML > General > Session Options). Logs from the server side will give us an idea of what the problem is. It would be great if you could just send the snip of logs spewed during login process ... View more

Hi,   If I am guessing right, the client is entering an infinite loop after login completes. If this is the case, then I guess the problem is with Max. Session Length value in the Role > General > Session Options > Max. Session Length section. Request you to please make the Max. Session Length value greater than 10 minutes (if it is not) and try again ... View more

Hi Marco,   As ray mentioned, the entity IDs are not same:   Entri ID: https://test.mydomain.com/dana-na/auth/saml-endpoint.cgi (on Pulse in Sign-in -> Sign-in SAML -> Metadata Provider -> Entity Id   Connect Secure Entry ID: https://test.mydomain.com/dana-na/auth/saml-endpoint.cgi?p=sp1   Request you to please try with the same entity IDs in both the auth server and the gsuite Admin console are the same ... View more

Hi Marco,   Is it possible to configure GSuite on a separate Sign-In URL such as say */gsuite and try again?     ... View more

Hi Zhenfang,   Thanks for the issue. As we have not come across this, we would like to know if you have done something specific that has caused this. This information will help us reproduce the issue ... View more

The second issue has been raised. The team is working on it. Will update with the dates once it is finalized ... View more

The kernel related issue is fixed, but another issue has been identified because of which the client still remains incompatible with Ubuntu 18.10 ... View more

Hi Lucas,   Request you to please share the following file:   $HOME/.pulse_secure/pulse/pulsesvc.log That would give an idea of what could have gone wrong ... View more

Are you using the Pulse Secure Linux Client? ... View more

Hi abcdefgh,   I am not aware of any other ways of doing it. Lets see if someone else has an idea ... View more

Hi abcdefgh,   Can you please try to start the container as root user (admin), and give the option --network host and see if the tunnel is established     If not, then I guess this is not supported in the client version that you are using. Here, I tried with 9.0 R3, and the tunnel was created with --network host option when starting docker container as root ... View more

Sorry for the mis-understanding. Docker does not seem to allow loading modules inside the container. Hence compiling would not work. Tried this option too, but did not work for me ... View more

Hi abcdefgh,     Tried reproing your issue over here. Looks like the issue is with tun module not being present inside the container. I guess the following would possibly resolve the issue (not tried though):   Install build-essential, openvpn and makedev in the container Compile tun.ko as detailed here inside the container Do a modprobe tun Try connecting after that Alternatively starting the container with --network host works over here. Below are the steps followed:     host # docker run --network host -t -i ubuntu:18.04 /bin/bash container # apt-get install kmod iproute2 net-tools lsb-release ca-certificates sudo uml-utilities container # dpkg -i pulse-version.deb container # Execute the dependencies installation script container # /usr/local/pulse/PulseClient_x86_64.sh ...   After running the above command, the tun adapter is created on host machine   host # ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:50:56:bf:7f:60 brd ff:ff:ff:ff:ff:ff inet 192.168.0.42/24 brd 192.168.0.255 scope global dynamic noprefixroute ens160 valid_lft 19967sec preferred_lft 19967sec inet6 fe80::4cb6:c89f:98a7:a763/64 scope link noprefixroute valid_lft forever preferred_lft forever 4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default link/ether 02:42:15:c9:fb:88 brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0 valid_lft forever preferred_lft forever inet6 fe80::42:15ff:fec9:fb88/64 scope link valid_lft forever preferred_lft forever 12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1400 qdisc fq_codel state UNKNOWN group default qlen 500 link/none inet 10.96.17.9/32 scope global tun0 valid_lft forever preferred_lft forever ... View more

Sorry for the delay. The issue is being analyzed now. Will update once we proceed further ... View more

Hi bernalvarela,   Thanks for mentioning this. An issue has been raised ... View more

Thanks awang :)       I will raise an issue mentioning the details provided by you ... View more

Hi awang,   Thanks for pointing out. Just verified the requirement for libicu by pulse:     [[email protected] pulse]# ldd pulseUi | grep -i libicu libicui18n.so.57 => /lib64/libicui18n.so.57 (0x00007f5c21443000) libicuuc.so.57 => /lib64/libicuuc.so.57 (0x00007f5c2109e000) libicudata.so.57 => /lib64/libicudata.so.57 (0x00007f5c1f621000)[[email protected] pulse]# rpm -ql libicu-57.1-8.fc27.x86_64 | grep -i libicudata.so.57 /usr/lib64/libicudata.so.57 /usr/lib64/libicudata.so.57.1 [[email protected] pulse]# Request you to please help us with a Fedora related web resource which confirms that Fedora 29 will not be having libicu. This will help us move forward ... View more

Hi bernalvarela,   Looks like the authentication scheme is Host Checker + SAML. If so, then it is not supported as per the release notes ... View more

Sorry, typo in the above post. Please consider the following comment:   For example, if say system_local is the realm which is tied to System Local authentication server, and /sys_local is the Sign-In URL which is mapped to system_local realm, then the values would be:   -r: system_local -U: https://<IP or FQDN of PCS>/sys_local   ... View more

Hi russellbateman,     As per my understanding, -r and -U are compulsary arguments. The default values for -r and -U are as follows: -r: Users -U: https://<IP/FQDN of PCS>/   However, if you have a separate realm and Sign-In policy created, then the above values would map as follows:   -r: Realm which is tied to the authentication server, where the user is present -U: The Sign-In policy that is using the realm   For example, if say system_local is the realm which is tied to System Local authentication server, and /sys_local is the Sign-In URL which is mapped to system_local realm, then the values would be:   -r: system_local -U: /sys_local ... View more

Hi @espenmy   Thanks for the information. Also, regret the inconvenience caused   I just noticed that the fix mentioned by you is there in the latest version 9.0 R2 of the client. Request you to please try that out     ... View more

Looks like /usr/local/pulse is not in PATH. Request you to please execute the following commands and try out again:     export PATH=$PATH:/usr/local/pulse export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/pulse PulseClient.sh -h <url> -u '<username>' -r <company> -L 5   ... View more

Sorry for the delay again :)   Yes, the proxy details in the log are not relevant. May be enabling detailed logging in the client side (if not enabled), would provide more details. This can be done by File > Logs > Log Level > Detailed. Request you to please try that   Also, hope you have installed the certificate as the non-root user. If you have installed the certificate as root user, and try connecting using the client as non-root user, it would fail. In case that is the issue, then request you to please install the certificate as a non-root user, and try logging in. Please don't forget to run PulseClient_x86_64.sh command "without" sudo   I am somehow not able to access the image that you have attached in the first post. Tried 3 different browsers and the behavior is the same. I will try to get access to the image ... View more

Hi Jean,   With the above settings (namely placing the Server's Issuer certificate in client machine's CA certificate folder, and installing the client certificate), it should ideally be possible to perform Cert. Auth. However, in this case, since the error is persisting even with the above steps, I feel we should look at the client side logs to see if we get a clue (~/.pulse_secure/pulse/pulsesvc.log). Is it possible to paste a snip of the happenings in the log when login attempt takes place? Also, what is the error that is thrown in the webkit UI? ... View more

Hi Jean,   Also, if the PCS Server Certificate is not Self Signed, then, you will have to install the CA certificate (the certificate that signed the PCS Server Certificate) instead ... View more

In any case request you to please try out the procedure above, and check whether Cert. Auth. works. If it does not, then you could check for any client certificate restrictions are configured at Users > User Realms > Specific User Realm > Authentication Policy > Certificate section. If any rules are defined, then ensure that the client certificate matches the rule properly ... View more