topic Re: LDAP Authentication questions in General Topics

LDAP Authentication questions

indevis — Thu, 02 Dec 2010 11:39:11 GMT

Hi everyone,

when I configure LDAP for authentication,
then I'm getting the groups in the distinguished name (dn) format.
I can choose them in policies and in the authentication profile.

Now my questions,
is the pan-agent then needed for policy authentication, too? Please explain why!
when I add a group in the dn format to the allow list
of an authentication profile, then it seems to be not matching when I'm trying to authenticate,
I have to add the users espacilly, is this right, or is the ldap connection not working correct?

Regards
Christian

Re: LDAP Authentication questions

jnguyen — Thu, 02 Dec 2010 16:27:27 GMT

you do not need to have pan agent to authenicate using ldap. it would seem like your ldap configuration is incorrect. please create a case and upload the tech support file for review of your ldap configuration.

Re: LDAP Authentication questions

migration — Wed, 02 Feb 2011 06:41:31 GMT

Sorry, I didn't understand.

Are you saying that if I have OpenLDAP to authenticate users in my company I don't need User-ID Agent/API to build security policy user based?

How can I get User-IP mapping in this situation?

Thanks

Re: LDAP Authentication questions

indevis — Wed, 02 Feb 2011 07:35:26 GMT

Hi,

yes you can authenticate users for SSL-VPN, Captive Portal!

Then you have to authenticate active with your user credentials.

And then you can use the LDAP groups in you policies.

But if you want transparently authenticate the users,

then you are right you need the agent for the user-ip-mapping.

That is what I get, when I was testing.

Hope that helps.

Regards

Christian

Re: LDAP Authentication questions

migration — Wed, 02 Feb 2011 09:00:27 GMT

Thank you so much!