topic Re: user-ID user mapping problems in General Topics

user-ID user mapping problems

SimasK — Fri, 18 Nov 2011 07:40:59 GMT

Our PA 4.1 has problems mapping entries received from user-ID agent and LDAP queries.

show user ip-user-mapping command produces following output:

192.168.1.1 AD grybai\vltr12345678

Here grybai is our NetBIOS domain name for domain and vltr12345678 is sAMAccountName attribute of user object in LDAP.

However command show user user-IDs (which shows information received by PA from LDAP queries) for the same user shows:

tadas.blinda@grybaiagrupe.eu vsys1 cn=b8710 users,ou=email,ou=groups,dc=corp,dc=grybaigroup,dc=eu

where tadas.blinda@grybaiagrupe.eu is userPrincipalName attribute for the same user.

During policy configuration PA web interface gives list of users in tadas.blinda@grybaiagrupe.eu , however such policy doesn't match traffic for that user. Policy with group also doesn't match traffic for that user.

If add policy with grybai\vltr12345678 user (I have to manually type user name during policy configuration), it matches traffic for that user.

LDAP server is configured as type active-directory, under "Group mapping settings" username field is configured as sAMAccountName (default). Tried to change that value with no lock.

Any ideas how to fix it?

Re: user-ID user mapping problems

supportOCA — Sun, 20 Nov 2011 06:08:38 GMT

For the group errors;

In the LDAP config, under active directory name, make sure this setting is in NETBIOS format not DNS name.

eg DOMAINNAME and not domainname.com

Re: user-ID user mapping problems

SimasK — Mon, 21 Nov 2011 15:54:15 GMT

In the User-ID_Upgrade_4.1 it is quite clearly noted not configure any domain unless device is working in multidomain environment, so we don't configured any. Before posting this post I tried to configure both netbios and dns domains without any luck.

Re: user-ID user mapping problems

Interface — Wed, 20 Jun 2018 12:49:50 GMT

Did You resolve this issue? I have same problem..