topic Re: question of user-id with not joined active-directory clients in General Topics https://live.paloaltonetworks.com/t5/general-topics/question-of-user-id-with-not-joined-active-directory-clients/m-p/36803#M27045 <HTML><HEAD></HEAD><BODY><P>Hi Eugene,</P><P></P><P>As customer has AD, I assume all users will have AD user account, but the computer is not in the domain.</P><P></P><P>In that case, you have three options:</P><P></P><P>1. Use NTLM + captive portal:</P><P>User must open a browser to go to any website before they are transparently authenticated at the backgound. The browser must support NTLM,such as IE and Firefox</P><P></P><P>2. Use LDAP:</P><P>Similar to method 1 but the login process is not transparent. User needs to input the username and password.</P><P></P><P>3. Use Kerberos:</P><P>Similar to method 2, but you are using the AD group rather than LDAP group here.</P></BODY></HTML> Mon, 08 Aug 2011 10:29:48 GMT jleung 2011-08-08T10:29:48Z question of user-id with not joined active-directory clients https://live.paloaltonetworks.com/t5/general-topics/question-of-user-id-with-not-joined-active-directory-clients/m-p/36802#M27044 <HTML><HEAD></HEAD><BODY><P>Hello all.</P><P>Customer has an Active-Directory. But clients are not joined Active-directory. <BR />Is it possible to configure User-ID with not joined active-directory clients at the Active-Driectory enviroment??</P><P></P><P>In other words, i don't want to configure user-id with RADIUS, eDirectory, Terminal Services and etc.</P><P></P><P></P><P>Thanks,</P><P>Eugene.</P></BODY></HTML> Mon, 08 Aug 2011 08:00:58 GMT https://live.paloaltonetworks.com/t5/general-topics/question-of-user-id-with-not-joined-active-directory-clients/m-p/36802#M27044 willstech 2011-08-08T08:00:58Z Re: question of user-id with not joined active-directory clients https://live.paloaltonetworks.com/t5/general-topics/question-of-user-id-with-not-joined-active-directory-clients/m-p/36803#M27045 <HTML><HEAD></HEAD><BODY><P>Hi Eugene,</P><P></P><P>As customer has AD, I assume all users will have AD user account, but the computer is not in the domain.</P><P></P><P>In that case, you have three options:</P><P></P><P>1. Use NTLM + captive portal:</P><P>User must open a browser to go to any website before they are transparently authenticated at the backgound. The browser must support NTLM,such as IE and Firefox</P><P></P><P>2. Use LDAP:</P><P>Similar to method 1 but the login process is not transparent. User needs to input the username and password.</P><P></P><P>3. Use Kerberos:</P><P>Similar to method 2, but you are using the AD group rather than LDAP group here.</P></BODY></HTML> Mon, 08 Aug 2011 10:29:48 GMT https://live.paloaltonetworks.com/t5/general-topics/question-of-user-id-with-not-joined-active-directory-clients/m-p/36803#M27045 jleung 2011-08-08T10:29:48Z