This page describes the initial setup steps for performing
Identity Provisioning to PaloAltoNetworks using TrustLogin as the identity source.

Note: For detailed operating instructions for PaloAltoNetworks, please refer to the documentation provided by PaloAltoNetworks.

Setup Steps

PaloAltoNetworks Settings

1. Log in to the CIE portal (Palo Alto Networks Cloud Identity Engine), and from the menu on the left, navigate to "Directory Sync" > "Directories".
   
    
2. Click the "Add New Directory" button.
   
    
3. Click the "Set Up" button in the "Cloud Directory" section,
   and select "SCIM" from the dropdown menu.
   
    
4. Select "Others" from the "SCIM Client" dropdown.
   
    
5. Enter any values of your choice in the "Directory ID" and "Directory Name" fields.
   
    
6. Click the "Generate Token" button in the "Authorization Method" section
   to generate a "Bearer Token".
    
7. Click the icon to the right of the generated token,
   and copy the "Bearer Token" to the clipboard. (This will be used in the TrustLogin settings.)
   
    
8. Click the "Submit" button at the bottom right of the screen.
   
    
9. When the "Action Required" pop-up appears, check "I have acknowledged this."
   
    
10. Click "OK" to save the settings.
     
    
    This completes the preparation on the PaloAltoNetworks side. Next, configure the settings on the TrustLogin side.
     

TrustLogin Settings

1. Log in to the TrustLogin Admin Page, and from the "Admin Page > Settings > Optional Features" menu,
   open "Settings" next to "Identity Provisioning."
   
    

2. Click "Add Service."
   
    
3. Select "PaloAltoNetworks" and click the "Add" button.
   
    
4. You will be redirected to the "Identity Provisioning > PaloAltoNetworks" page.
   Click the "Edit" button.
   
    

5. Open "Access Settings," enter the following value for the setting item, and click "Save."
   

   SCIM Token

   The "Bearer Token" you copied in PaloAltoNetworks Settings ① > Step 7

    

6. After saving the settings, click the "Connect" button to perform the initial synchronization.
    
7. If the button status changes to "Connected," the initial synchronization was successful.
   Note: It may take some time for the status to be reflected on the PaloAltoNetworks side.
   
    

Next step: For the user synchronization settings manual, see here

Available Values for Attribute Mapping

The following values that can be specified as default functions for PaloAltoNetworks are as follows.

Note: For an overview of the attribute mapping feature and how to configure it, see here.