topic Re: Using LDAP/AD names for firewall GUI login in General Topics

Using LDAP/AD names for firewall GUI login

aveva_palo — Tue, 18 Jan 2011 15:48:35 GMT

I believe I've successfully set up LDAP authentication in our Palo device. All of our groups and users are appearing when searched for using "show user ldap-server server all" and they show up in Authentication Profiles when changing the Allow List.

I have added my user account from our AD domain into the LDAP Authentication Profile as detailed in the "eDirectory and LDAP Authentication with PANOS" document, but I'm not sure how to progress in getting this to be used for authorisation when logging into the firewall itself.

If I go into create a new administrator account, the authentication profile drop-down only lists "None" - I had imagined this would let me specify a user based on LDAP but it seems not.

Am I barking up the wrong tree, or should I be able to authenticate to the admin GUI using LDAP users? If so is there a step I'm missing in enabling this?

Regards

John Bousfield

Re: Using LDAP/AD names for firewall GUI login

James — Tue, 18 Jan 2011 17:04:31 GMT

Hi John,

For this to work - you should have your LDAP server as a choice in the drop down.

The "Name" section would be your username in the LDAP server. You would need to make an entry like this for each administrator. This is OK for a small number of Admins.

If you expect to have many - then please check out this document using RADIUS and VSA's:

https://live.paloaltonetworks.com/docs/DOC-1701

Thanks

James

Re: Using LDAP/AD names for firewall GUI login

aveva_palo — Wed, 19 Jan 2011 10:18:39 GMT

Hi James

Thanks for your reply. That's how I imagined it should work and doing it for each user manually is fine for now.

However, when I go in to add the new administrator account I'm unable to select anything other than "None" - there is no option for my other Authorisation profiles (including a RADIUS profile already set up).

The help system indicates the same thing you have which is that I should have the list of Auth Profiles there.

Could there be some setting I've missed to enable new users to use all Auth Profiles?

Regards

John

Re: Using LDAP/AD names for firewall GUI login

James — Wed, 19 Jan 2011 11:54:13 GMT

Hi John,

Is it definitely Auth and not server profiles that you have configured?

Thanks

James

Re: Using LDAP/AD names for firewall GUI login

aveva_palo — Wed, 19 Jan 2011 12:25:12 GMT

Hi James

I've got both Server Profile and Authentication Profiles configured. Tried to attach an image of these but it doesn't seem to let me...

Server Profile has the LDAP servers listed and I can do looks ups to AD so those seem fine. User Idenfitication is also in place and seems to be working fine getting groups and users when I check via the command line.

The Authentication Profiles include the one for LDAP, one for LocalDB and one for RADIUS at the moment. The LDAP Auth profile uses the LDAP Server Profile above, includes my AD account and an AD group in the Allow List and has sAMAccountName as the login attribute.

None of the Auth Profiles appear in the drop-down though.

Appreciate any help.

Regards

John

Re: Using LDAP/AD names for firewall GUI login

James — Thu, 20 Jan 2011 23:40:40 GMT

Hi John,

Sorry, been out an about

I suggest you contact support - it does not sound right. I think we'll definitely need pictures here

I am sure we could get this solved

Thanks

James

Re: Using LDAP/AD names for firewall GUI login

aveva_palo — Fri, 21 Jan 2011 10:39:57 GMT

Hi James

I'll raise a support issue with our support contact directly but I have also attached the images of each config page to the post so you can have a quick browse of the settings I've got in place.

Thanks for your help.

Regards

John

Re: Using LDAP/AD names for firewall GUI login

aveva_palo — Wed, 26 Jan 2011 10:03:12 GMT

For reference the problem was that my LDAP Server Profile and LDAP Authorisation Profiles were set to use VSYS but needed to be set to as Shared - you can't use Vsys profiles to authorise administrative users, which makes sense.

This can't be altered once a profile is made so I removed both profiles and recreated as shared (tick box near the top of the form).

I can now use LDAP to authorise users.

John

Re: Using LDAP/AD names for firewall GUI login

James — Wed, 26 Jan 2011 14:53:22 GMT

Hi John,

Good news!!

Thanks

James