In an Explicit Proxy deployment where no agent can be used on the endpoint, which authentication method is supported with mobile users?

In an agentless Explicit Proxy deployment for mobile users, SAML (Security Assertion Markup Language) is the supported authentication method. When a user's browser, configured for the explicit proxy, makes a web request, Prisma Access intercepts it and redirects the user to a configured Identity Provider (IdP) for authentication. This browser-based redirection mechanism is ideal for mobile users who are not on the corporate network and do not have a client agent installed. After successful authentication with the IdP, a SAML assertion is sent back, granting the user access.

A. LDAP: LDAP is primarily used by Prisma Access for user-to-group mapping after authentication, not as the direct authentication protocol for web requests from mobile users in an explicit proxy flow.
B. Kerberos: Kerberos authentication requires the client to have direct network connectivity to a Key Distribution Center (KDC), typically a domain controller. This is not feasible for mobile users off the corporate network.
D. SSO: Single Sign-On (SSO) is a capability or outcome, not a specific authentication protocol. SAML is one of the primary protocols used to achieve SSO, making SAML the more precise and correct answer.

1. Palo Alto Networks TechDocs - Prisma Access Administrator's Guide: "Authentication for Explicit Proxy." This section explicitly states, "To authenticate users, explicit proxy uses SAML authentication. When a user attempts to access a web page, Prisma Access redirects the user to the identity provider (IdP) for authentication."

2. Palo Alto Networks TechDocs - Prisma Access Administrator's Guide: "Configure Explicit Proxy on Prisma Access." The workflow diagram and configuration steps in this section detail the SAML redirection process as the core mechanism for user authentication in this deployment model.