topic Re: Administrator Authentication with ldap in General Topics

Administrator Authentication with ldap

Westcon2 — Thu, 03 Jul 2014 00:55:55 GMT

Trying to create role based user account for monitoring the firewall. I tried to use ldap authentication. However it seems there is some issue with using ldap

I am facing this error after trying to authentication with correct credentials and below are the logs

Although it shows authenticated, but still the invalid username and / or password on the GUI

Is it that it can't be done using ldap?

Regards

Aamir Khan

Re: Administrator Authentication with ldap

HULK — Thu, 03 Jul 2014 01:05:39 GMT

Hello Aamir,

Could you please let us know the PAN OS version running on this PAN firewall and is the username contains non-alphanumeric characters such as "/"...?

Thanks

Re: Administrator Authentication with ldap

hshah — Thu, 03 Jul 2014 01:10:51 GMT

You may want to refer following document for more detail.

Defining Granular Admin Role Profiles

Re: Administrator Authentication with ldap

Westcon2 — Thu, 03 Jul 2014 01:14:56 GMT

I am using 6.0.3, however i test it on 6.0.1 with same result.The password is alpha numeric

Re: Administrator Authentication with ldap

hshah — Thu, 03 Jul 2014 01:16:22 GMT

Lets say you want to create Role based authentication for user Robert, than make sure Devcie > Administrator > & Name is Robert, if its different it will not work.

Good news is it works with LDAP.

Re: Administrator Authentication with ldap

hshah — Thu, 03 Jul 2014 01:18:57 GMT

Re: Administrator Authentication with ldap

Westcon2 — Thu, 03 Jul 2014 01:22:53 GMT

The Problem is I am not using predefined roles. I am having custom roles.

Re: Administrator Authentication with ldap

Westcon2 — Thu, 03 Jul 2014 01:26:57 GMT

Re: Administrator Authentication with ldap

hshah — Thu, 03 Jul 2014 01:26:58 GMT

Hi Westcon,

For Custom Role and Standard Role, configuration is same. So I think that is not the problem.

Do you have runtime.in/iseadmin or iseadmin in Administrator filed? I think this is the issue.

Regards,

Hardik Shah

Re: Administrator Authentication with ldap

hshah — Thu, 03 Jul 2014 01:27:43 GMT

Instead iseadmin can you try "runtime.in/iseadmin " ?

Re: Administrator Authentication with ldap

Westcon2 — Thu, 03 Jul 2014 01:30:03 GMT

iseadmin is a user in ldap. However I want to give this user access to the firewall for monitoring only.

Re: Administrator Authentication with ldap

bat — Thu, 03 Jul 2014 01:41:31 GMT

Hello Westcon,

For non local admins LDAP is not supported and only Radius is supported for remote login users. I tested this in lab and found similar results:

You can also see that in the window (Device > Setup > Authentication settings) while mentioning the authentication profile there is a statement that "Only Radius is supported"

Thanks

Chetan

Re: Administrator Authentication with ldap

Westcon2 — Thu, 03 Jul 2014 01:46:54 GMT

Harsha,

It did the trick having the username in the administrator profile. But the problem is if I have 3 users then I have to create 3 administrator profile each with the username.

I can't create a common template name

2014-07-03 05:50:42.747 +0400 Running cmd: insert into admusers values (?, ?)

2014-07-03 05:50:42.747 +0400 Error: pan_authd_update_admin_user_in_db(pan_localdb_utils.c:186): Failed to add user:iseuser1 (uid:508) to /opt/pancfg/mgmt/global/db/admusers.db

2014-07-03 05:50:42.747 +0400 debug: pan_authd_process_authresult(pan_authd.c:1353): pan_authd_process_authresult: runtime.in\iseuser1 authresult auth'ed

2014-07-03 05:50:42.748 +0400 Request received to unlock shared/Ldap_admin/runtime.in\iseuser1

2014-07-03 05:50:42.748 +0400 User 'runtime.in\iseuser1' authenticated. From: 80.227.87.218.

2014-07-03 05:50:42.748 +0400 debug: pan_authd_generate_system_log(pan_authd.c:866): CC Enabled=False

2014-07-03 05:50:42.749 +0400 debug: pan_authd_service_req(pan_authd.c:3322): Authd:get group request

2014-07-03 05:50:42.750 +0400 debug: pan_authd_handle_group_req(pan_authd.c:3210): Got user role/adomain / for user iseuser1

Regards

Aamir Khan

Re: Administrator Authentication with ldap

bat — Thu, 03 Jul 2014 02:30:17 GMT

Hi Aamir,

You can use the same authentication profile for all the users. Can you explain in more detail why you cannot create a common template name ?

-Chetan

Re: Administrator Authentication with ldap

Westcon2 — Thu, 03 Jul 2014 05:37:58 GMT

Hi Chetan,

Since the firewall does not support ldap authentication for non-local users. So even if showing successfully authenticated in the logs, It tries to look in to the administrator tab if there is any username of the same name which it authenticated.

If we use custom name, it won't find the username and will show the error "invalid username or password". So that is why we need to create individual administrator profile corresponding to the name we authenticated or else use radius.

Regards

Aamir Khan

Re: Administrator Authentication with ldap

pulukas — Fri, 04 Jul 2014 11:01:07 GMT

If you have a windows server in the environment, you can add the RADIUS role and use this with the PA custom dictionary.

How to Configure Radius on Windows 2008

Configuring Administrator Authentication with Windows 2008 RADIUS Server (NPS/IAS)