All mobile users are unable to authenticate to Prisma Access (Managed by Strata Cloud Manager) using SAML authentication through the Cloud Identity…

The error message "400 Bad Request" during a SAML authentication flow, specifically after the user is redirected from the Identity Provider (IdP), strongly indicates a misconfiguration in the SAML communication. The scenario explicitly states that authentication is handled "through the Cloud Identity Engine (CIE)." In this architecture, CIE acts as the Service Provider (SP) in the SAML transaction with the external IdP. Therefore, the SAML metadata, which includes critical information like entity IDs, Assertion Consumer Service (ACS) URLs, and signing certificates, must be perfectly aligned between the CIE and the IdP. A mismatch in this metadata is the most common cause for a "400 Bad Request" error, as the receiving party (CIE) cannot correctly process the SAML assertion from the IdP.

A. The SAML trust relationship is established with the Cloud Identity Engine, not directly with Strata Cloud Manager. Checking the configuration in Strata Cloud Manager would be incorrect for this specific flow.
B. A security policy rule would typically result in a traffic block or a different type of denial message, not a "400 Bad Request" error related to the SAML protocol itself.
D. While reviewing logs is a valid troubleshooting step, it is a method to gather more data. The specific error message already points directly to a SAML configuration problem, making verification of the metadata the most direct action to identify the root cause.

1. Palo Alto Networks - Cloud Identity Engine Administrator's Guide: In the section "Set Up a SAML 2.0 Identity Provider," the guide details the procedure for configuring SAML authentication. It states, "To use an identity provider (IdP) to authenticate users, you must configure the Cloud Identity Engine to communicate with your IdP. You can do this by importing the IdP's metadata into the Cloud Identity Engine and exporting the Cloud Identity Engine's metadata to the IdP." This highlights that the primary configuration and metadata exchange occurs between CIE and the IdP. (Reference: Cloud Identity Engine Administrator's Guide, "Authentication" -> "Set Up a SAML 2.0 Identity Provider").

2. Palo Alto Networks - Prisma Access Administrator’s Guide (Strata Cloud Manager): The guide explains how Prisma Access leverages authentication services. For mobile users, an Authentication Profile is configured which can point to the Cloud Identity Engine as the authentication source. This confirms that for SAML, Prisma Access relies on the pre-established trust between CIE and the IdP. (Reference: Prisma Access Administrator’s Guide (Strata Cloud Manager), "Get Started with Prisma Access" -> "Authentication for Mobile Users").

3. Palo Alto Networks - Troubleshoot Cloud Identity Engine: Troubleshooting documentation for SAML failures consistently points to metadata mismatches as a primary root cause for errors like "400 Bad Request." Common issues listed include incorrect Entity ID, Assertion Consumer Service (ACS) URL, or certificate problems, all of which are defined within the SAML metadata. (Reference: Palo Alto Networks TechDocs, "Troubleshoot Cloud Identity Engine" -> "SAML Authentication Failures").