Get Started with OIDC SSO

Prisma Cloud offers a Service Provider (SP) initiated SSO capability. Leveraging OpenID Connect OpenID Connect (OIDC), this option enables Prisma Cloud System Administrators to allow users to sign in to Prisma Cloud with their Identity Provider (IdP) credentials using the Sign in via SSO option on the login page. Learn more about setting up SP-initiated SSO below.

To avoid account lockout while making configuration changes, enable administrative users with both local authentication credentials on Prisma Cloud and SSO access. Ensure that each administrator has activated their Palo Alto Networks Customer Support Portal (CSP) account using the Welcome to Palo Alto Networks Support email and set a password to access the portal.

oidc sso

The Sign in via SSO button enables login with a configured OIDC SSO provider. To sign in using third party Security Assertion Markup Language (SAML) SSO, use the Identity Provider defined for the SAML integration with the Prisma Cloud tenant.

Complete the steps below on the Prisma Cloud console and your IdP to set up OIDC:

  1. Log in to Prisma Cloud using an account with System Administrator privileges to configure SSO and redirect login requests to the IdP’s login page.

  2. Complete the following steps on your Prisma Cloud tenant:

    1. Select Access Control > SSO and select OIDC as shown below.

      oidc

    2. Copy the Audience URI value. This is a read-only field in the format that uniquely identifies your instance of Prisma Cloud. This value is required to configure OIDC on your IdP.

      tt:[NOTE:] The Prisma ID of a tenant is displayed adjacent the OIDC configuration so that it can be shared with users that may have access to multiple tenants. If you have access to multiple tenants on a stack you will be required to enter the Prisma ID of the tenant you are logging into.

  3. Complete the setup on the IdP.

    1. Review the workflow for your IdP.

  4. Add the Callback URI previously created on Prisma Cloud to the IdP.

  5. Login to the Prisma Cloud console to verify that SP initiated SSO set up is complete.