topic Cloud Identity Engine Group Mapping in Cloud Identity Engine Discussions

Cloud Identity Engine Group Mapping

Claw4609 — Tue, 02 May 2023 22:41:09 GMT

It seems like guest users arent matching any groups with Cloud Identity Engine. We have SAML (Azure) setup for our GlobalProtect authentication (not throught Cloud Identity Engine). We have CIE configured on the firewall under user identification. The Cloud Identity Engine is configured to sync the Azure directory but if I look on the firewall using show user user-ids match-user it shows no groups. We have on-prem users that sync up to Azure and those pull groups fine however the guest accounts do not, so accounta we invite into Azure and arent synced on prem dont match any groups.

If I go to CIE itself I can see the user there and the groups they are a part of but the firewall doesnt pull any of those groups, the certain groups are used for different agent configs for GlobalProtect. Is there a reason if wouldn't be pulling the groups that it should need? Do I need to use a SAML auth profile through CIE itself?

Running command "show user cloud-identity-engine statistics all" returns Failed with error code: -20001

Configure the Cloud Identity Engine as a Mapping Source on the Firewall (paloaltonetworks.com)

Re: Cloud Identity Engine Group Mapping

nikoolayy1 — Wed, 24 May 2023 08:52:52 GMT

Try using SCIM in Azure AD and then refence the CIE in the firewall auth profile:

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/authenticate-users-with-the-cloud-identity-engine/configure-the-cloud-identity-engine-in-an-authentication-profile

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/choose-directory-type/configure-a-cloud-based-directory/configure-scim-connector-for-the-cloud-identity-engine

Re: Cloud Identity Engine Group Mapping

sdoorey01 — Tue, 08 Aug 2023 06:55:40 GMT

i'm having exactly the same issue. did you end up solving this?

Re: Cloud Identity Engine Group Mapping

Claw4609 — Tue, 08 Aug 2023 21:00:09 GMT

Opened a TAC case on it and ours ended up being an error/bug with the user-id service on the firewall side. We restarted the service and it fixed the issue.

Commands ran:

>debug software restart process user-id-agent
>debug user-id refresh group-mapping all

The error we were getting was shown in the dscd.log file. Cli command for that: less mp-log dscd.log

Re: Cloud Identity Engine Group Mapping

nikoolayy1 — Mon, 21 Aug 2023 06:26:22 GMT

dscd is the process for the cloud identity engine connection from the firewall, so this explains the workaround.

Edit: Also you could automate the process restart each night till you upgrade to a stable version following article:

https://live.paloaltonetworks.com/t5/general-articles/automating-the-palo-alto-ngfw-s-process-deamon-restarts/ta-p/529328#M605