Hi [email protected] , thank you for your reply.   Why did it is only on some chrome and not on all? I have the same Chrom version, on two different PC, on one works and on another no.   Can I set   JS security on chrome, to allow it?   ... View more

Hi, I have the same problem after enabled Host Checker. Did you solved it? ... View more

Thanks a lot. I solved it with your support ... View more

Thanks for the reply, but I can't use the WSAM because is out of support:   https://kb.pulsesecure.net/articles/Pulse_Technical_Bulletin/TSB43810     ... View more

Hi, thank for your reply. I tryed you solution, but I don't understand this step: Navigate to  Users>User Roles>roleName>SAM Click on  Add Server… under Options I created a WSAM destination (under SAM>Application) with IP and port, is it correct? I need to enable VPN Tunneling under Users>USer Roles>My Role>General   The web application is on AWS, and its Inbound rules IP is allow only the external IP of the SSLVPN, I need to configure it to allow the user to access to link by SSLVPN. ... View more

Hi Ray,   could you help me to configure this, please:   NOTE:  If you're using Windows 10 RS5 (1809 update), please use PSAM (Enable  Pulse Secure Client   option on the user role + WSAM >> Connect directly from Pulse Client / Logon through web browser to get the Pulse Client installed) and check the behavior.   I need to allow web access to external IP passing by SSLVPN, because the external IP allow connection only from Public SSLVPN IP.   ... View more

Hi zanyterp,  how can I set expresison in Pulse to receive email from SAML respond and query my LDAP to check if this email is a ggroup set in the role mapping? ... View more

Hi  csuchindra, thank you so much for your reply. This is a good solution but is not my request.   In this solution, I can't use groups but custom attribute. I need to use groups to manage them by GSUITE and not by PULSE.   Thanks. Marco Ferrara ... View more

I configured only G SUITE as IdP, I don't have LDAP server configured, and I could not configure one. I would like to use only GSUITE with groups.   For this, I must configure a Service Provider?  Do you know as configure GSUITE for return the groups info? In Pulse how must set? Only samlMultiValAttr.groups as expression in role mapping.   Thanks for the support ... View more

Hi, but for setting the groups in role mapping, I must configure a Metadata  Service Provider? Because I configured only a Identity Provider. In this case is GSUTE or Pulse? ... View more

the problem is that GSUITE doesn't want to give me assistance! ... View more

Hi Ray, thank you so much for your reply.   The problem is that I like use GSUITE for not use Domain Controller, because more users are only email on GSUITE and not have user on Domain Controller, and I have different AD domains that I'll must manage under Pulse.    My best solution is will use only GSUITE, but for easy assign roles to users, I thought to use associaton in role mapping with GSUITE groups, and not insert all single emails in role mapping.   ... View more

Hi Ray, thanks for your reply, but I'm confusing. If I set a LDAP DC, after how can use the email gsuite to add they in the groups on LDAP? ... View more

Hi, thanks a lot for your reply, but I'm confused.   Can I use GSUITE as LDAP and configure it in PULSE to enable login by email and set permission by Groups?   Thanks Marco ... View more

Hi,  in the log (Log/Monitoring > User Access > Log) I see this record every second Info SML31067 2019-05-14 12:15:17 - xxx-xxx-xxxxx02 - [127.0.0.1] System()[] - SAML AuthnRequest generation succeeded for SigninUrl:'https://test.mydomain.com/gsuite', SSO Service URL: 'https://accounts.google.com/o/saml2/idp?idpid=X1234xxx5'   and in Log/Monitoring > Events > Logs Minor AUT24604 2019-05-14 12:21:13 - xxx-xxx-xxxxx02 - [00.0.00.0] System()[] - SSL negotiation failed while client at source IP '00.0.00.0' was trying to connect to 'IP Internal Cluster PSA'. Reason: 'sslv3 alert certificate unknown' ... View more

Hi, thank you so much for your reply, yes is my problem, but I don't understand where I set this change.   On Pulse I see only this: User Realms -> Test_SAML -> General -> Session Option -> Idle Timeout: 600 minutes (min: 5) Max. Session Length: 720 minutes (min: 6) Reminder Time: 5 minutes (min: 3)   But the poroblem didn't solve. ... View more

Hi, thanks for the reply, but the two records are pre compiled and I can't modify them!   I change in GSUITE the  Entity ID * in https://test.mydomain.com/dana-na/auth/saml-endpoint.cgi?p=sp1   and tried to connecting, but after login, the system forwarding in loop without load page (The page url is changed every second but does not load content) ... View more

These are my steps:   1. [Pulse] Set setting SAML -> Configuration -> SAML -> Settings Timeout value for metadata fetch request: 300 Validity of uploaded/downloaded metadata file: 0 Cluster FQDN for SAML: test.mydomain.com -> Save change -> Save -> Update Entity Ids -> Update Entity Ids   2. [GSUITE] Create APPs SAML -> Admin Console -> Apps -> SAML Apps -> Add a service/App to your domain -> SETUP MY OWN CUSTOM APP download metadata and certificate -> Next Application Name: PULSE_SSLVPN -> Next ACS URL: https://test.mydomain.com/gsuite Entri ID: https://test.mydomain.com/dana-na/auth/saml-endpoint.cgi (on Pulse in Sign-in -> Sign-in SAML -> Metadata Provider -> Entity Id:) Name ID: Basic Information - Primary Email Name ID Format: Email -> Next -> Add new mapping email - Basic Information - Primary Email -> Finish -> Edit services -> ON for everyone -> SAVE   3. [Pulse] Create Auth. Server -> (selected) SAML Server -> New Server Server Name: SAML_Server SAML Version: 2.0 Connect Secure Entry ID: https://test.mydomain.com/dana-na/auth/saml-endpoint.cgi?p=sp1 Configuration Mode: Manual Identity Provider Entity Id: https://accounts.google.com/o/saml2?idpid=XX123xxx4 Identity Provider Single Sign On Service URL: https://accounts.google.com/o/saml2/idp?idpid=XX123xxx4 SSO Method: Post Upload Certiuficate (from GSUITE pem downloaded before) Select Requested Authn Context Classes to be sent in the AuthRequest: ????? Secure Remote Password Metadata Validity: 9999 - Save changes   4. User Roles > New -> Test_SAML General -> Session Options UI Options Pulse Secure client Web Secure Application Manager Windows version VPN Tunneling 5. [Pulse] User Realms User Realms > User Authentication Realms -> New Name: GSuite_Users Authentication: SAML_Server -> Save Change 6. [Pulse] Role Mapping -> New Rule based on: username Name: GSUITE_RoleMapping Rule:If username...: * Available Roles: Test_SAML Stop processing rules when this rule matches -> Save changes   7. [Pulse] Sign-in Policies -> Signing In > Sign-in Policies -> New Url User type: Users Sign-in URL: */gsuite/ Authentication realm -> User picks from a list of authentication realms Ues -> GSuite_Users -> Save Change 8. I try to connect by the url: And after login I receive this error: 403. That’s an error. Error: app_not_configured_for_user Service is not configured for this user. Request Details idpid=C0189zsi8 SAMLRequest= RelayState=https://test.mydomain.com/gsuite That’s all we know.   thanks to all for the support ... View more

Thanks for your reply,  I opened an incident on Pulse support, but replied me that the problem is on G SUITE and can't help me ... View more

Hi, thanks for the reply.  I have configured but did't work.    Please what are all steps (in order) to configure correctly SAML w9ith GSUITE?   Es 1) set SMAL Server in configuration -> SAML -> Setting 2) New metadata provider in Configuration -> SAML   etc...   Thanks ... View more

Sorry I don't understand this:   You're right, selecting  Don't Rewrite (with redirect)  will redirect the users to go the webpage directly which then should be tunneled by  WSAM proxy  and the VPN server should be able to send the traffic out using it's Internal port.   With Don't Rewrite (with Redirect) the IP is the local Ip of the pc and not the SSLVPN IP correct?   I created a  Web Access Policies  and add the AWS IP, now (whitout Don't Rewrite) I can see the portal by SSLVPN IP but I have a view problem that all component isn't load correctly. ... View more

Hi Ray, thanks for your reply.   But if I select  Don't Rewrite (with redirect) the IP ins't of SSLVPN and the page is not visible.   Thanks Marco ... View more

Hi,   I have */ and I change in Gsuite configuration but I can't resolve.   Thanks Marco ... View more

      Hi Ray, thank you so much for your reply.   I changed the ACS url but I don't understand where I can see how I set the mapped the SAML realm to */ sign-in URL on the VPN server. Is it in Authentication -> Signing In > Sign-in Policies    Thanks Marco ... View more