topic Re: User-ID & LDAPS service account AD permissions in Next-Generation Firewall Discussions

User-ID & LDAPS service account AD permissions

S.Cain — Mon, 17 Nov 2025 16:58:03 GMT

Can someone please tell me what all AD membership permissions are required for a service account for User-ID agent and LDAPS.

CosminM — Mon, 17 Nov 2025 17:09:46 GMT

Hello @S.Cain ,

S.Cain — Mon, 17 Nov 2025 17:14:40 GMT

Thanks. What about for LDAPS integration?

CosminM — Mon, 17 Nov 2025 17:55:36 GMT

User-ID has two components:

mapping usernames with IP addresses (IP-to-user mapping), and I assume that for this reason you need to configure a service account (Map IP Addresses to Users)
knowing AD security groups membership (group-mapping), and for this component you need to configure an LDAP Server Profile (inside that you can use LDAP or LDAPS protocol - How to Configure LDAP Server Profile - Knowledge Base - Palo Alto Networks). After you configure Group Mapping Settings that will use your LDAP Server Profile (Map Users to Groups)