topic Re: Multiple Domain and domain name in General Topics

Multiple Domain and domain name

NomiosSupport — Thu, 13 Jun 2013 08:53:18 GMT

Hello,

I have deployed 1 cluster of PA 3020(5.0.5) and UIA on 2 servers of the domain.

The domain architecture is as following:

1 parent domain: idf.local

6 child domain: xx.idf.local, yy.idf.local, ...

UIA works well and we have good informations on the PA with NETBIOS domaine name

show user ip-user-mapping all:

IDF\user1

XX\user2

YY\user3

But with the group mapping, it's fqdn domain that appears.

show user group name "cn=ggggggg,ou=fffffffff,dc=idf,dc=local":

idf.local\user1

xx.idf.local\user2

yy.idf.local\user3

LDAP server profile configuration is done with global catalog:

admin@XXXXXX(active)# show shared server-profile ldap profile-AD-GC

profile-AD-GC {

server {

gtgt50.idf.local {

port 3269;

address 192.168.1.1;

}

ldap-type active-directory;

base DC=idf,DC=local;

bind-dn "CN=login,......,DC=idf,DC=local";

timelimit 30;

bind-timelimit 30;

bind-password -AQ==SdRlIx0rvZ/zcM4qhyMPexBjphE=Xce5R8I57K7Xi1MRcJdzBg==;

ssl yes;

}

[edit]

The problem is that I can't create policy based on AD group because there is a mismatch between UIA and Group Mapping information.

Any idea?

Thanks!!

Re: Multiple Domain and domain name

UhMayYeah — Thu, 13 Jun 2013 09:53:18 GMT

Can you try using IDF as a domain in the LDAP server profile and refresh the group-mapping :

> debug user-id refresh group-mapping <>

Re: Multiple Domain and domain name

NomiosSupport — Thu, 13 Jun 2013 15:05:02 GMT

I have already tried this but it overrides all domain name:

show user group name "cn=ggggggg,ou=fffffffff,dc=idf,dc=local":

IDF\user1

IDF\user2

IDF\user3

The problem is that user2 belongs to XX domain which is the domain child(xx.idf.local).

Re: Multiple Domain and domain name

Retired Member — Fri, 14 Jun 2013 10:05:06 GMT

Hello,

Try creating separate LDAP Server (port 389 or 636) profiles for the parent domain and each child domain including in the configuration NetBios-style domain name and corresponding base.

In Group Mapping Settings create Group Mapping configuration using every LDAP Server Profile (8 in total).

Hope this helps! Update if it does 😉

Global Catalog is used for identifying membership in Universal Groups.

Re: Multiple Domain and domain name

VinceM — Fri, 14 Jun 2013 10:29:53 GMT

As albert_C said, create one ldap profile per server and configure "Domain" in the profile then, domain name will be re-write as you want.