topic Re: AD group for administratoin using authentication through LDAP in General Topics

AD group for administratoin using authentication through LDAP

TheOriginalgiga — Thu, 16 May 2013 18:22:36 GMT

I'm trying to authenticate an AD group for administrative access for our PA. I'm missing the last step to implement it and I may have some of the steps messed up. could someone fill in the blanks for me?

Create an LDAP profile
Create an authentication profile
???

Sorry if this question has been covered before.

Thanks

Re: AD group for administratoin using authentication through LDAP

goku123 — Thu, 16 May 2013 18:42:02 GMT

#3. Create an administrator under Device>administrators and assign the auth profile from #2 to the user.

Re: AD group for administratoin using authentication through LDAP

TheOriginalgiga — Thu, 16 May 2013 18:51:08 GMT

In the administrator section, can I use the AD group name (such as "firewall Admins") or will it have to be per individual user within that group?

Re: AD group for administratoin using authentication through LDAP

goku123 — Thu, 16 May 2013 19:11:08 GMT

It would be per user.

If you would like to use user groups on AD, then you can try to use RADIUS since with RADIUS, you can return attributes for authorization (which cannot be done with LDAP - hence each user has to be created on the firewall, assigned a role and authenticated remotely).

Here is a document describing the configuration for RADIUS with VSA for your reference: https://live.paloaltonetworks.com/docs/DOC-1765

Re: AD group for administratoin using authentication through LDAP

TheOriginalgiga — Thu, 16 May 2013 20:49:40 GMT

thank you, exactly what I wanted to know.