topic Re: Global Protect portal authentication with LDAP fails in General Topics

Global Protect portal authentication with LDAP fails

usvi — Tue, 19 Feb 2013 11:00:07 GMT

We have set up GP to authenticate against an AD server . User group mapping has done and u can pull the users . However, whenever you try to connect with one of the users from the GP client or portal web page , you get authentication fails message . Connecting with local db works fine . Any ideas ? I saw an article about spaces in the authentication profile . The profile has no space it is called localAD.

Re: Global Protect portal authentication with LDAP fails

gafrol — Tue, 19 Feb 2013 11:07:59 GMT

Hi,

I don't know what the problem with LDAP against AD could be in your case, but for the same purpose I am using a Kerberos Server Profile and a Kerberos Authentiction Profile in order to authenticate GP users against our MS AD. It looks like this

Maybe you can give it a try ?

Roland

Re: Global Protect portal authentication with LDAP fails

usvi — Tue, 19 Feb 2013 11:26:23 GMT

Hello,

Upgraded the client to 1.2.1 now localdb doesn't work . I do get the cert error and allow it to import it

Re: Global Protect portal authentication with LDAP fails

usvi — Tue, 19 Feb 2013 12:15:21 GMT

Did that and still doesnt work

Re: Global Protect portal authentication with LDAP fails

gafrol — Tue, 19 Feb 2013 12:32:45 GMT

Take small steps. Does localdb authentication work again ?

Re: Global Protect portal authentication with LDAP fails

usvi — Tue, 19 Feb 2013 12:42:13 GMT

Yes . It does . I had to downgrade to 1.1.6 and use the original cert that was created when the box was deployed . Now I connect using local db , still no AD nor Kerberos connectivity

Re: Global Protect portal authentication with LDAP fails

gafrol — Tue, 19 Feb 2013 13:21:41 GMT

Which PANOS is running on your box ?

Re: Global Protect portal authentication with LDAP fails

usvi — Tue, 19 Feb 2013 14:58:23 GMT

4.1.8 . Had to call TAC and they got to work . DN binding was incorrect and we missed the samaccountname under ldap authentication profile .

Re: Global Protect portal authentication with LDAP fails

gafrol — Tue, 19 Feb 2013 15:14:40 GMT

That's why I'm using Kerberos for authentication, it's much easier no fiddling around with bindings and samaccountnames etc.

Re: Global Protect portal authentication with LDAP fails

usvi — Tue, 19 Feb 2013 16:55:45 GMT

I guess , we shall use Kerberos on other deployments