topic Re: User mapped via CLI but no through Web-UI in General Topics

User mapped via CLI but no through Web-UI

COMIP — Wed, 03 Jul 2013 14:31:21 GMT

Hello all:

I am trying to configure an user in a security policy but when I write the first 4 letters of his username it doesn't appear (screenshoot attached). However, it does appear throug CLI:

admin@PA1(active)> show user ip-user-mapping all | match mmlu

10.161.34.189 vsys1 UIA idc\mmluque 3516 3516

Any clue about the problem?.

Thanks so much,

Best regards

Re: User mapped via CLI but no through Web-UI

zarina — Wed, 03 Jul 2013 17:05:34 GMT

The ip-user mapping is received through the agent. If you need to use groups/users in the policy make sure to configure group mapping on the device: Device -> User Identification -> Group Mapping Settings

Re: User mapped via CLI but no through Web-UI

Retired Member — Wed, 03 Jul 2013 17:51:47 GMT

debug user-id refresh dp-uid-gid

debug user-id refresh group-mapping all

debug user-id refresh user-id agent all

can you try these.how many DC do you have in LDAP profile ?

Re: User mapped via CLI but no through Web-UI

COMIP — Thu, 04 Jul 2013 15:50:23 GMT

Thanks for your answers. Today the user didn't appear neither CLI nor web-ui. Tomorrow I'll try it again.

@panos, in my LDAP profile I have 4 servers.

Re: User mapped via CLI but no through Web-UI

COMIP — Mon, 08 Jul 2013 09:42:59 GMT

Hello:

I launched the 3 commands but the problem persists, I see the user through CLI but not in web-ui.

Regards

Re: User mapped via CLI but no through Web-UI

kprakash — Mon, 08 Jul 2013 12:54:44 GMT

Hello Comip,

It appears that there is a mismatch between the group names that is being fetched from the agent, and from the firewall when it talks directly to the LDAP server for group mapping. Do you have any "Domain" name configured under the LDAP server settings? If so, can we delete the domain name and commit the changes, and see if it makes a difference?

Thanks and best regards,

Karthik RP

Re: User mapped via CLI but no through Web-UI

COMIP — Mon, 08 Jul 2013 13:00:23 GMT

I have the domain 'idc' configured in 'Domain' field. I manage Palo Alto through Global Protect VPN authenticated through LDAP and if I delete the idc in that field, I am not be able to authenticate through Global Protect, my user appears as 'invalid user'.

Best regards