topic Re: Update: Admin users AD authentication in General Topics

Admin users AD authentication HELP

GobiernodeNavarra — Tue, 21 Sep 2010 11:27:57 GMT

I am trying to configure login to the firewall GUI via Active directory authentication with virtual systems on, I followed the document "eDirectory and LDAP Authentication with PANOS", but when I configured Administrators on Authentication Profile only appears shared not vsys defined profiles. On shared Authentication Profile, groups and users from AD doesn’t appear. Please Help.

Thanks

Re: Admin users AD authentication HELP

mharding — Tue, 21 Sep 2010 13:27:23 GMT

Try setting up a RADIUS server instead.

Re: Admin users AD authentication HELP

blacksan — Tue, 21 Sep 2010 13:40:52 GMT

The Admin, SSL VPN and Capture Portal uses the same Authentication Profile (LDAP/RADIUS) instead of the Pan-Agent LDAP (Novell/Active Directory)

Follow the same directions on how to setup LDAP profile for Capture profile or SSL VPN.

The biggest issue I had with the LDAP profile with that it does not work with Pan-Agent user structure (Domain\User) like the RADIUS profile. So you will need to manually add user accounts instead of using Pan-agent setup.

Re: Admin users AD authentication HELP

GobiernodeNavarra — Wed, 22 Sep 2010 13:06:47 GMT

I can only select shared Authentication Profile when I configure an Administrator, and

I can’t add users because I don’t get to see them on the shared Ldap profile.

Thanks

Update: Admin users AD authentication

GobiernodeNavarra — Fri, 24 Sep 2010 09:39:53 GMT

Finally I’ve solved the authentication issue,

I’ve created an Authentication profile and added manually admin user names on Additional users.

On administrators I’ve created a new administrator with the same name as the AD user, after I assigned the authentication profile below, and administrator rights.

But I don’t want to create a new administrator for each admin user, I want to use AD groups.

Thanks

Re: Update: Admin users AD authentication

James — Fri, 24 Sep 2010 12:12:09 GMT

Hi There,

You can use the user "all" instead.

More details and doc can be found in this thread:

https://live.paloaltonetworks.com/message/3103#3103

Thx

James