topic Re: Is there a way to tie the Cert auth to AD username for AD auth? in General Topics

Is there a way to tie the Cert auth to AD username for AD auth?

Tue, 09 Dec 2014 00:02:59 GMT

Hi Guys,

Is there a way to make sure that the GP checks that the AD user name matches the certificate common name when using both AD and Cert profiles for authenticating users?

Thanks,

Re: Is there a way to tie the Cert auth to AD username for AD auth?

bat — Tue, 09 Dec 2014 00:05:17 GMT

Hi x,

I think you can, while creating a certificate profile you can provide the username field as (Subject) common name.

Hope it helps !

Re: Is there a way to tie the Cert auth to AD username for AD auth?

Tue, 09 Dec 2014 00:24:32 GMT

Thanks, that is what I have although, on IOS or Android, it doesn't seem to be doing that check. I will confirm.

Re: Is there a way to tie the Cert auth to AD username for AD auth?

Tue, 09 Dec 2014 05:01:11 GMT

So as per TAC, there is no option to do this. They are two independent checks and are not tied together. I was told to submit a feature request.

Re: Is there a way to tie the Cert auth to AD username for AD auth?

sspringer — Tue, 09 Dec 2014 05:12:21 GMT

Hi,

This should be possible in PanOS 6.0 - the following release notes describe a bug fix included in PanOS 6.0.0:

51091—Two-factor authentication (where both a client certificate profile and an

authentication profile are configured) was not functioning as expected. The client was

not required to provide the login credentials associated with the authentication profile

after successfully authenticating with the client certificate

Have you tested with Windows or Mac clients? maybe there is limitation with mobile clients.

Re: Is there a way to tie the Cert auth to AD username for AD auth?

Tue, 09 Dec 2014 05:52:26 GMT

That's what I'm looking for. I did test 6.0 (6.1) at one point and I remember that it was forcing me to use the username on the certificate but didn't realize this wasn't the case on version 5. I'm pretty sure it works on Windows so I need to confirm if it also works on non-windows machines. I'm hoping it will because this will be the solution.

Thanks so much for your help!